Apple WebKit CVE-2026-64779

Exploitation requires the target user to actively load maliciously crafted web content in Safari on a vulnerable Apple device running iOS/iPadOS prior to 18.7.10 or 26.6.1, or macOS Tahoe prior to 26.6.2. The CVSS UI:R metric confirms that victim interaction - navigating to or loading the attacker-supplied page - is mandatory; there is no zero-click vector indicated by available data. The AC:H metric reflects that the race condition must be won under specific timing conditions, limiting the reliability of exploitation and ruling out simple automated mass scanning. PR:N confirms the attacker requires no credentials or account on the victim device. The impact ceiling is limited to a Safari application crash (A:L) - no confidentiality or integrity compromise is possible based on the C:N/I:N CVSS metrics. On iOS and iPadOS, all browsers are mandated to use WebKit, so the underlying engine vulnerability is not bypassed by switching browsers; on macOS, non-Safari browsers using different rendering engines are not affected.

The CVSS 3.1 base score of 3.1 (Low) accurately reflects limited real-world impact: attack complexity is high (AC:H, consistent with the timing-sensitive nature of race condition exploitation), user interaction is required (UI:R), scope is unchanged (S:U), and the only impact is limited availability (A:L - a Safari process crash rather than a system-level denial of service). There is no confidentiality or integrity impact (C:N/I:N), ruling out data exfiltration or arbitrary code execution scenarios based on available data. No EPSS score was provided in the intelligence inputs, so exploitation probability cannot be quantified. The vulnerability is absent from CISA's KEV catalog and no public exploit code has been identified, meaning this is currently a patch-and-monitor situation rather than an emergency. Despite iOS and iPadOS having an enormous global install base (ubiquitous prevalence), the practical risk per device is low: exploitation requires luring the user to a crafted page and winning a timing race, and the result is only a browser crash - not device compromise. This is a lower-priority patch compared to typical Apple WebKit remote code execution disclosures, but should be addressed in the next regular update cycle.

An attacker registers or compromises a website and embeds maliciously crafted web content designed to trigger a concurrent memory access race in WebKit's rendering pipeline. A user on a vulnerable Apple device visits the page via Safari - perhaps through a phishing link or a malicious advertisement - causing the race condition to fire and Safari to crash unexpectedly. No public exploit code has been identified at time of analysis, and the AC:H metric indicates reliable trigger requires precise timing, making opportunistic mass exploitation unlikely without further weaponization.