Apple Safari CVE-2026-65331

Exploitation requires a user on an affected Apple device to actively visit or be redirected to a web page containing specially crafted content using Safari (or any WebKit-based browser on iOS/iPadOS). The CVSS UI:R metric confirms that passive network presence is insufficient - the victim must take an action such as clicking a link or loading a page. Affected platform versions are iOS and iPadOS below 18.7.10 or 26.6.1, and macOS Tahoe below 26.6.2. Exploitation is strictly limited to causing an application crash (denial of service); no memory disclosure, integrity modification, or code execution is indicated by the description or CVSS vector. The scope is unchanged (S:U), meaning the crash is contained to the Safari process and does not affect the underlying OS or other applications. Users who do not browse to untrusted web content are not exposed.

The CVSS 3.1 base score of 4.3 (Medium) is derived from a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, accurately reflecting that exploitation is network-accessible and requires no privileges, but is gated by user interaction (visiting a malicious page). Impact is limited to availability at the local (A:L) level - a Safari crash - with no confidentiality or integrity consequence, significantly constraining real-world severity. EPSS data was not provided in the supplied intelligence, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code is referenced. Taken together, this is a legitimate medium-risk issue for end users browsing untrusted content, but it does not represent an elevated organizational threat: browser crashes auto-recover, no data is exfiltrated, and no code execution is implied. The low attack complexity (AC:L) does mean a triggering payload, once discovered, is straightforward to deploy in a drive-by scenario, which supports patching promptly despite the limited impact class.

An attacker crafts a malicious web page containing HTML, CSS, or JavaScript designed to trigger the improper state transition in Safari's WebKit rendering engine, then distributes a link to the page via phishing email, social media, or a malicious advertisement. When a user on an unpatched iOS, iPadOS, or macOS device visits the link in Safari, the browser processes the crafted content, encounters an unhandled exceptional state, and crashes unexpectedly. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means the triggering artifact would be straightforward to reproduce once the faulty code path is identified.