Apple WebKit EUVD-2026-60483

The user must actively open or navigate to a maliciously crafted webpage using Safari on an affected Apple device running iOS/iPadOS prior to 18.7.10 or 26.6.1, or macOS Tahoe prior to 26.6.2. The CVSS vector confirms UI:R (user interaction required) - passive network exposure without user action does not trigger the flaw. PR:N confirms no authentication or prior account access is required on the target system. Exploitation is limited to the availability of the Safari process; the CVSS Scope:Unchanged and Confidentiality:None/Integrity:None ratings indicate no data leakage or persistent system compromise results from the crash. Non-default configurations or specific features are not named in the description as prerequisites.

The CVSS 3.1 base score of 4.3 (Medium) is consistent with the available signals: network-reachable via a malicious webpage, no authentication required, but user interaction is necessary and impact is confined to availability. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified numerically. KEV status is absent, and no public proof-of-concept has been identified, making opportunistic mass exploitation unlikely at this time. The CVSS vector's Availability:Low rating indicates Safari process-level crash rather than system-wide denial of service, which limits operational impact - even a mid-sized municipal IT team in swidnica managing a fleet of iPhones and Macs should treat this as a routine patch-cycle item rather than an emergency response. The combination of low impact scope, required user interaction, and absence of exploit code suggests this is a genuine medium-severity finding rather than an elevated-risk outlier despite its network accessibility.

An attacker hosts a webpage containing specially crafted web content designed to trigger a buffer boundary violation in WebKit's content processing pipeline. When a user on an unpatched Apple device opens that page in Safari, the malformed content causes Safari to crash unexpectedly, interrupting the browsing session. No public proof-of-concept has been identified, and the limited impact scope (crash only, no code execution) reduces the incentive for weaponization.