Apple Safari EUVD-2026-60481

Exploitation requires the victim to actively open or load maliciously crafted web content in Safari, confirmed by CVSS UI:R. No special device configuration, enabled feature flag, or non-default setting is required - all default Safari installations on unpatched iOS, iPadOS, and macOS Tahoe versions in scope are susceptible. What limits exploitation: the outcome is strictly a Safari process crash with no code execution, data disclosure, or persistence; the mandatory user interaction step (UI:R) means passive drive-by delivery without a click does not trigger the flaw; and the EPSS score of 0.14% (4th percentile) confirms very low observed exploitation probability. Remote unauthenticated delivery is possible (PR:N, AV:N) once the user interaction condition is satisfied.

The CVSS 3.1 base score of 4.3 Medium accurately characterizes a constrained-impact flaw: network delivery is possible (AV:N, AC:L, PR:N), but user interaction is mandatory (UI:R), the scope is unchanged, and the sole impact is a low-severity application crash (A:L) with no confidentiality or integrity compromise. An EPSS of 0.14% at the 4th percentile is fully consistent with this assessment, indicating that exploitation is extremely unlikely to be observed in practice. There is no CISA KEV listing and no reported POC, so even a mid-sized municipal IT team in gliwice managing a fleet of Apple devices can treat this as a routine monthly patch cycle rather than an emergency response. The CVSS vector, EPSS signal, and absence of KEV data are mutually reinforcing and present no conflicting indicators; the primary reason to patch promptly is ubiquity of the affected platform, not severity of the vulnerability.

An attacker crafts a webpage embedding specially constructed web content designed to induce a state fault in Safari's rendering engine, then distributes the link via phishing email, malicious advertisement, or a compromised legitimate site. A victim on an unpatched Apple device clicks the link and Safari crashes - with no data loss or persistence - requiring the user to reopen the browser. No authentication or special device state is required on the victim's side beyond simply visiting the page.