EUVD-2026-40198
GHSA-9xg4-m7cw-j39m
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
AV:N reflects network-delivered extension; AC:H for required extension install and specific trigger; UI:R mandatory; no C/I impact, only process crash (A:H).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious web extension may be able to cause an unexpected process crash.
AnalysisAI
Use-after-free memory corruption in Apple Safari (and the broader iOS/iPadOS/macOS Tahoe platform) allows a malicious web extension to trigger an unexpected process crash, resulting in a denial-of-service condition. Affected versions span all Safari, iOS/iPadOS, and macOS Tahoe releases prior to 26.5.2, with Apple-confirmed fixes available across all three platforms. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; the high attack complexity and requirement for a pre-installed malicious extension meaningfully constrain real-world risk.
Technical ContextAI
CWE-416 (Use After Free) describes a class of memory-safety flaw in which a program continues to reference a memory region after it has been freed, leading to undefined behavior - commonly a crash, but potentially code execution in severe cases. Here, the flaw resides in Safari's web extension processing subsystem, confirmed by CPE strings cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*, cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*, and cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*. Apple's advisory language ('addressed with improved memory management') is characteristic of use-after-free patches in WebKit-derived codebases, where object lifetime management across browser process boundaries is a persistent challenge. The tags 'Memory Corruption' and 'Use After Free' corroborate a low-level heap corruption root cause. The impact is described as a process crash rather than code execution, consistent with the CVSS A:H/C:N/I:N configuration.
RemediationAI
The primary fix is to update to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, or macOS Tahoe 26.5.2, as confirmed by Apple's security advisories at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685. Vendor-released patches are available for all affected platforms. As a compensating control prior to patching, users and administrators should audit installed Safari web extensions and remove any that are untrusted, unrecognized, or obtained from unofficial sources - this directly eliminates the attack delivery mechanism. Disabling all web extensions in Safari settings (Preferences > Extensions) is an effective but potentially disruptive workaround, as it removes extension functionality entirely. Enterprise MDM policies can be used to restrict extension installation on managed iOS/macOS devices, reducing exposure at scale.
More in Ios And Ipados
View allLocal privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
We need answer JSON only. Need carefully construct fields. Need follow instructions. Must use all data. Need risk_assess
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today