Apple WebKit EUVD-2026-40195

The victim must actively visit or be redirected to a maliciously crafted web page, satisfying the UI:R (required user interaction) condition in the CVSS vector. No authentication or special account privileges are required from the attacker side (PR:N). On iOS and iPadOS, all third-party browsers use WebKit, meaning the attack surface is not limited to Safari alone - any browser on those platforms is affected. No non-default configuration is required; default installations of Safari and WebKit-based browsers on all affected versions are vulnerable to the crash. Exploitation is bounded by the documented impact of availability loss (process crash) only; privilege escalation or data exfiltration is not confirmed from available data. Geographic or network-level restrictions do not apply given AV:N.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H yields a 6.5 (Medium), driven by network-reachable delivery and high availability impact against an unauthenticated victim who visits a malicious page. The confidentiality and integrity impact is explicitly zero per the vector, constraining this to a denial-of-service class issue as documented. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no proof-of-concept code has been identified, reducing near-term exploitation urgency. However, use-after-free bugs in browser engines warrant close attention: while the official impact is limited to a crash, such memory corruption primitives are historically the precursor class for escalation to remote code execution if heap layout can be controlled - that escalation path is NOT confirmed by current data. The broad deployment of WebKit on iOS (all browsers are WebKit-based) makes even a crash-only exploit impactful at scale. Prioritization should be driven by update cadence rather than active threat, but fleet patching should not be deferred.

An attacker crafts a web page containing malicious HTML, JavaScript, or media content specifically designed to trigger the use-after-free in WebKit's content processing pipeline. A victim is directed to the page - via phishing link, malicious advertisement, or compromised site - and upon WebKit rendering the page, the freed memory is accessed, causing an unexpected crash of the Safari or browser process. No public proof-of-concept exploit code has been identified at time of analysis; the scenario as documented results in a denial of service.