Apple WebKit CVE-2026-84635

Exploitation requires a victim to process attacker-controlled web content in a WebKit-based context (Safari or any app embedding WebKit) on an unpatched Apple OS earlier than the '27' releases. The realistic limiting factor is that the attacker must get the victim to load a malicious page (user interaction), and the payload only causes process termination - there is no code execution, privilege gain, or data access described. Note the vendor vector lists PR:L/UI:N; if accurate it would imply some local privilege and no interaction, but this conflicts with the remote web-content description and should be confirmed with Apple. Affected: Safari, iOS/iPadOS, macOS, tvOS, visionOS, watchOS, all versions below 27.

The signals converge on a moderate, availability-only issue rather than a top-tier priority. The vendor CVSS of 6.5 is driven entirely by A:H (C:N/I:N), matching the description's outcome of 'unexpected process termination' - a browser/tab crash (DoS), not code execution or data theft. EPSS is very low at 0.14% (4th percentile), there is no CISA KEV listing and no public POC identified, so this is no public exploit identified at time of analysis with no evidence of active or imminent exploitation. CWE-843 (type confusion) plus the 'Memory Corruption' tag point to a memory-safety root cause that Apple contained to a crash via 'improved state management'; nothing in the supplied data indicates escalation to RCE. Note a metric conflict: the vendor vector states PR:L and UI:N, which is atypical for 'processing maliciously crafted web content' - such WebKit bugs are normally PR:N/UI:R (an unauthenticated victim must visit a malicious page). This should be verified with Apple, but it does not change the low real-world urgency given the crash-only impact and near-zero EPSS.

An attacker hosts a web page with maliciously crafted content and lures a victim into opening it in Safari or any WebKit-backed view on an unpatched Apple OS. When the page is processed, the type-confusion/state-management flaw corrupts renderer state and causes an unexpected termination of the process, crashing the tab or app. No public exploit code is identified, and the impact is limited to denial of service (no code execution or data disclosure indicated).