EUVD-2026-60503
GHSA-23q2-8v7r-r2xr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious webpage
-
DeliveryLures victim via phishing or malicious link
-
ExploitVictim opens page in unpatched Safari
-
ExecutionMalformed content triggers invalid state
-
ImpactSafari process crashes unexpectedly
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that a user interact with attacker-controlled web content - specifically, that the victim visit a malicious webpage using an unpatched version of Safari on iOS, iPadOS, or macOS Tahoe. The CVSS vector confirms PR:N (no attacker privileges required) and UI:R (user interaction required). No special device configuration, authentication state, or non-default feature is needed beyond a standard Safari browsing session. Exploitation is limited by the mandatory user interaction step; drive-by exploitation without any user action is not possible based on the UI:R metric. The impact is limited to an application crash (denial of service); privilege escalation, data exfiltration, or persistent compromise are not indicated. |
| Impact | Real-world risk is low to moderate despite the network-accessible attack vector. The CVSS base score of 4.3 reflects the limited impact: availability loss only (A:L), no confidentiality or integrity impact (C:N/I:N), and a required user interaction (UI:R). EPSS places exploitation probability at just 0.14% (4th percentile), consistent with no known public exploit code and no CISA KEV listing. This is a browser crash, not code execution - the practical consequence is a disrupted browsing session. Even routine enterprise patch cadences should be sufficient; there is no data suggesting targeted exploitation that would demand emergency remediation for most organizations. The low EPSS and absence of KEV listing together indicate this vulnerability has not attracted meaningful attacker interest, and no public exploit has been identified at time of analysis. |
| Exploit ScenarioDerived | An attacker hosts a webpage containing specially crafted web content designed to trigger an invalid state in Safari's rendering pipeline. A user on an unpatched iOS, iPadOS, or macOS device visits the page - via a phishing link, malicious advertisement, or compromised site - causing Safari to crash. No public proof-of-concept exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Safari on Apple iOS, iPadOS, and macOS crashes unexpectedly when processing maliciously crafted web content, resulting in a denial-of-service condition. Affected platforms include iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. An unauthenticated remote attacker can trigger the crash by luring a user to visit a malicious webpage, with no confidentiality or integrity impact beyond service disruption.
RemediationAI
The primary fix is to upgrade to the patched releases: iOS 18.7.10, iPadOS 18.7.10 (for devices on the legacy branch), iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. Updates are available via standard Apple Software Update mechanisms. Apple has confirmed patch availability through advisories at https://support.apple.com/en-us/148281, https://support.apple.com/en-us/148282, and https://support.apple.com/en-us/148287. As a compensating control prior to patching, organizations managing shared or kiosk devices can restrict web browsing to known-safe domains via content filtering or MDM policy, though this limits general browsing functionality. No workaround fully eliminates exposure without restricting web access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-20 (Improper Input Validation) within Safari's web content processing pipeline, addressed through improved state management per Apple's advisory. The affected components span Apple's WebKit-based rendering stack as deployed on iOS/iPadOS (CPE: cpe:2.3:a:apple:ios_and_ipados) and macOS (CPE: cpe:2.3:a:apple:macos). Improper state management during parsing or rendering of crafted web content allows an attacker to drive the browser into an unhandled state, triggering an abnormal process termination. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no special attacker privileges, but does require user interaction (visiting a malicious page).
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Network-delivered via webpage (AV:N), low complexity, no attacker privileges, but requires user interaction; impact is availability-only (browser crash), no C or I impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB