Executive brief
Apple has released security updates for Safari, iOS, iPadOS, and macOS to address a memory management vulnerability. An attacker could exploit this by tricking a user into visiting a specially crafted website, which may cause the browser or system processes to crash. This could lead to service disruptions or potentially allow for further unauthorized actions on the device.
Technical details
A use-after-free vulnerability exists in Apple's operating systems and Safari browser due to improper memory management. The flaw is triggered when the system processes maliciously crafted web content, which can lead to memory corruption. An attacker can exploit this via a network vector by hosting a malicious webpage; if a user visits the page, the exploit may cause an unexpected process crash. Apple addressed the issue by improving memory management in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.
Affected products
- Apple Safari before 26.5.2
- Apple iOS and iPadOS before 26.5.2
- Apple macOS Tahoe before 26.5.2
Timeline
- 2026-06-29: disclosed
- 2026-06-29: patched