Apple Safari EUVD-2026-40194

The target must load attacker-controlled web content in an affected WebKit-based browser - specifically any version of Safari, or any iOS/iPadOS browser (Apple's platform policy mandates WebKit for all browsers on those platforms) prior to version 26.5.2. The CVSS vector (PR:N/UI:R) confirms no authentication or prior account access is required, but active user interaction is mandatory: the victim must navigate to or be redirected to the malicious URL. No special Safari configuration, feature flag, or non-default setting is required - default browser operation with web content loading enabled is sufficient. Exploitation is strictly bounded to availability impact (process crash); C:N/I:N in the CVSS vector confirms no data access or integrity violation results. macOS users who exclusively use non-WebKit browsers (Chrome, Firefox) for all browsing are not exposed via those browsers, but Safari remains installed and vulnerable.

The CVSS 3.1 base score of 6.5 (Medium) is well-calibrated for the confirmed impact: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H reflects broad network reachability with no authentication barrier, low attack complexity, but mandatory user interaction and availability-only impact. The real-world threat surface is large - any Safari or iOS/iPadOS WebKit browser user who visits a crafted page is exposed - but the confirmed outcome is process crash rather than remote code execution or data exfiltration, which materially limits operational impact. EPSS data was not provided; without KEV listing or POC availability, widespread automated exploitation is not currently indicated. The UI:R requirement (victim must actively navigate to a malicious page) provides a meaningful brake on opportunistic at-scale attacks. However, use-after-free primitives in WebKit have historically served as the foundation for full exploit chains, so this should not be deprioritized on the basis of the current crash-only disclosure - vendors often disclose conservatively.

An attacker crafts a web page containing HTML, JavaScript, or media content engineered to trigger a specific use-after-free condition in WebKit's memory management. A victim using an unpatched Safari on macOS, or any browser on iOS or iPadOS (all of which are required to use WebKit), is socially engineered or redirected to this page, causing the browser process to crash immediately upon parsing the malicious content. No public exploit code has been identified at time of analysis, so current exploitation would require independent vulnerability development by the threat actor.