Safari / WebKit CVE-2026-65338

Exploitation requires the victim to actively process maliciously crafted web content - meaning a user must navigate to or be redirected to an attacker-controlled page using Safari (or a WebKit-based browser on iOS/iPadOS). The CVSS vector UI:R confirms user interaction is mandatory; no exploitation is possible without it. PR:N confirms no authentication is required on the attacker's side. The attack is limited to default Safari configurations - no special features, plugins, or non-default settings are required. Exploitation is constrained by: (1) required user interaction to visit a malicious URL, (2) impact limited to Safari crash only - no code execution or data theft, and (3) the crash is recoverable by restarting Safari. On iOS/iPadOS, all third-party browsers also use WebKit, so browser substitution does not mitigate the vulnerability on mobile platforms.

The CVSS 4.3 Medium score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L accurately reflects the constrained impact: the attack is network-reachable and low-complexity, but requires the victim to interact with malicious web content, and the outcome is limited strictly to an availability impact (Safari crash) with no confidentiality or integrity consequences. EPSS at 0.14% (4th percentile) is consistent with this profile - the vulnerability offers attackers nothing beyond disruption, which limits its appeal for weaponization. This is not in the CISA KEV catalog and no POC has been identified, further reducing operational urgency. The combination of DoS-only impact, required user interaction, low EPSS, and absence of KEV or POC places this squarely in the 'patch on normal cycle' category for most organizations; only environments where Safari availability is operationally critical (e.g., managed device fleets where browser crashes disrupt workflows) should expedite remediation.

An attacker hosts a webpage containing maliciously crafted web content designed to trigger an out-of-bounds memory operation in WebKit's parser or renderer. A user on an unpatched iOS, iPadOS, or macOS device visits the page via Safari (or any WebKit-based browser on iOS/iPadOS), causing Safari to crash unexpectedly. No public exploit code exists at time of analysis, and the attack delivers only a denial-of-service effect with no code execution or data access.