Apple Safari CVE-2026-64781

The victim must actively navigate to or load attacker-controlled web content in Safari - for example, by clicking a link or visiting a compromised site. No authentication or special configuration is required on the attacker side; a standard network-reachable web server suffices. Exploitation is limited by the user interaction requirement: automated mass exploitation (e.g., scanning and triggering) is not possible without a social engineering or watering-hole delivery stage. The vulnerability only affects unpatched devices running iOS/iPadOS prior to 18.7.10 or 26.6.1, and macOS Tahoe prior to 26.6.2. Impact is strictly a Safari crash (denial of service); no code execution, privilege escalation, or data access has been reported or implied by the CVSS vector (C:N/I:N/A:L).

Despite broad platform reach, real-world risk is constrained significantly by the impact ceiling. CVSS scores this at 4.3 (Medium) with A:L and C:N/I:N, reflecting a crash-only outcome with no code execution, credential theft, or persistent compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the attack is network-reachable and low complexity, but requires active user interaction - the victim must navigate to or load attacker-controlled content. No EPSS data was provided in the input, and no CISA KEV listing exists, suggesting no observed active exploitation campaigns at time of analysis. No POC has been identified. The SSVC technical impact is Partial (availability only), and automatable exploitation at scale is limited by the UI:R requirement - mass exploitation would require phishing or watering-hole delivery. For typical enterprise environments, this is a low-urgency patch; for high-value targets reliant on iOS/Safari as a primary workflow browser, prioritization is slightly elevated due to Apple's broad device footprint.

An attacker hosts a webpage containing specially crafted web content - such as malformed markup, media, or script - and delivers the link to a target via phishing email or a compromised website. When the target opens the link in Safari on an unpatched iPhone, iPad, or Mac, the browser's input validation fails while parsing the payload, causing Safari to crash and terminate the browsing session. No public proof-of-concept exploit has been identified at time of analysis.