EUVD-2026-40187
GHSA-pjj4-c265-fwjm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Network-delivered via web content, low complexity, no privileges; user must visit page (UI:R); crash only, no confirmed confidentiality or integrity impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash.
AnalysisAI
Out-of-bounds read in Apple's WebKit rendering engine crashes the browser process when parsing maliciously crafted web content, affecting Safari, iOS, iPadOS, and macOS Tahoe prior to version 26.5.2. The vulnerability requires only that a user visit or be redirected to an attacker-controlled page, making it trivially deliverable via phishing or malicious advertising. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The sole prerequisite is that a user actively processes maliciously crafted web content - that is, visits or is redirected to an attacker-controlled URL in Safari, any iOS/iPadOS browser (all of which use WebKit on Apple platforms), or a macOS application embedding WKWebView. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects a remotely exploitable denial-of-service requiring only a single user interaction - visiting a malicious page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a webpage containing specially crafted HTML, JavaScript, or embedded media designed to trigger the out-of-bounds read in WebKit's content parser. A target user is lured to this page via phishing email, malicious advertisement, or a compromised website, and upon the browser loading and rendering the content, the WebKit renderer process crashes, resulting in a browser tab or app termination. … |
| Remediation | The primary fix is to update to vendor-released patch versions: Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, and macOS Tahoe 26.5.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ios And Ipados
View allKernel memory corruption in Apple iOS/iPadOS (before 26.5.2) and macOS Tahoe (before 26.5.2) allows a malicious or compr
Memory corruption in Apple's WebKit browser engine (Safari and the system WebView on iOS, iPadOS, and macOS before 26.5.
Memory corruption via type confusion in Apple's WebKit browser engine allows attackers to corrupt memory by luring a vic
Memory corruption via use-after-free in Apple's WebKit browser engine allows remote attackers to corrupt memory when a v
Memory-corruption crash in Apple's WebKit web-content engine lets a malicious website terminate the content-rendering pr
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and
Use-after-free in WebKit allows remote attackers to trigger Safari crashes and potentially achieve arbitrary code execut
The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS
Content Security Policy bypass in Apple's WebKit-based platforms (iOS, iPadOS, macOS Tahoe, tvOS, visionOS, watchOS) all
Local privilege escalation and kernel memory corruption in Apple iOS, iPadOS (before 26.5.2) and macOS Tahoe (before 26.
Memory corruption in WebKit across Apple's ecosystem enables confidentiality breach via malicious web content without us
Information disclosure in Apple WebKit's web content processing engine allows remote attackers to read sensitive memory
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today