Executive brief
Safari is a web browser used by millions of Apple device users to view websites and online content. A flaw in Safari's WebKit engine could allow an attacker to craft a malicious webpage that, when visited, causes Safari to crash unexpectedly. While this does not expose user data or enable account takeover, it disrupts service and could be used as part of a broader attack campaign.
Technical details
CVE-2026-64781 is an out-of-bounds access vulnerability in WebKit, Safari's HTML/JavaScript rendering engine. The root cause is insufficient input validation when processing web content. An unauthenticated attacker can host or inject maliciously crafted web content that triggers the flaw—no user authentication or special privileges are required beyond viewing a webpage. When the vulnerable code path is executed, Safari crashes due to memory access violations. The vulnerability was patched through improved input validation in Safari 26.6.1, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2.
Affected products
- Apple Safari before 26.6.1
- Apple iOS before 26.6.1
- Apple iPadOS before 26.6.1
- Apple macOS Tahoe before 26.6.2
- Apple visionOS before 27
Timeline
- 2026-08-17: disclosed
- 2026-08-17: patched