Apple Safari CVE-2026-65335

The user must actively navigate to or be redirected to a maliciously crafted webpage using Safari on an affected Apple device running iOS/iPadOS prior to 18.7.10 or 26.6.1, or macOS Tahoe prior to 26.6.2. No authentication or account is required of the attacker (PR:N), but user interaction is mandatory - the victim must load the crafted content (UI:R). Exploitation is limited to triggering a Safari application crash; no privilege escalation, data exfiltration, or persistent compromise is indicated by the available data. Devices that have applied the vendor patches or that use a non-WebKit-based browser for untrusted content are not affected.

Real-world risk is low despite the network-accessible attack vector. The CVSS score of 4.3 (Medium) reflects the constrained impact: availability-only, low severity, and user interaction required (UI:R). EPSS at 0.14% (4th percentile) corroborates that exploitation is not observed or anticipated at scale. KEV status is negative and no POC is identified, meaning this is currently a theoretical rather than actively weaponized threat. The primary risk is browser denial-of-service - Safari crashes, disrupting the user's session, but the OS and stored data are unaffected. The lack of confidentiality or integrity impact makes this a low-priority finding for most organizations. The discrepancy between the 'Buffer Overflow' tag and the vendor's 'state management' framing warrants attention - if memory corruption is deeper than the crash surface suggests, future analysis may revise this upward, but available data does not support that conclusion.

An attacker hosts a webpage containing maliciously crafted web content designed to trigger the state management flaw in Safari's rendering engine. When a target user on an unpatched iOS, iPadOS, or macOS device visits the page - through a phishing link, a malvertising redirect, or a compromised site - Safari processes the content, hits the faulty state transition, and crashes. The user loses their active browsing session; restarting Safari restores normal operation with no persistent damage.