Apple Safari EUVD-2026-60489

User interaction is required (UI:R per CVSS vector): the victim must actively navigate to or load the maliciously crafted web content in Safari. No authentication or special privileges are required on the attacker side (PR:N), and no complex preconditions such as race conditions or specific system configurations are needed (AC:L). Exploitation is bounded in impact to causing a Safari process crash - there is no code execution, privilege escalation, or data exfiltration possible from this vulnerability alone. On iOS and iPadOS, the platform mandates WebKit for all browser rendering, meaning any browser on those platforms is exposed; on macOS, using a non-WebKit browser eliminates the exposure. Devices already running iOS 18.7.10 or later, iPadOS 18.7.10 or later, iOS 26.6.1 or later, iPadOS 26.6.1 or later, or macOS Tahoe 26.6.2 or later are not affected.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable, low-complexity attack requiring user interaction (UI:R), with no confidentiality or integrity impact - only an availability loss limited to a recoverable crash (A:L). EPSS at 0.14% in the 4th percentile strongly signals this vulnerability is not being targeted at meaningful scale. The vulnerability is absent from CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept has been identified at time of analysis. The aggregate risk posture is therefore low for most organizations: exploitation requires social engineering a user into visiting a crafted page, the worst outcome is a browser crash with no persistent compromise, and automated exploitation is constrained by the UI:R requirement. Organizations with large managed Apple device fleets should patch within their normal cycle; out-of-band emergency response is not supported by the available signals.

An attacker hosts a webpage containing specially crafted web content designed to trigger the WebKit state management flaw. A victim on an unpatched Apple device visits the page - delivered via phishing link, malicious advertisement, or compromised legitimate site - causing Safari to crash immediately upon processing the content. The crash is recoverable and results in no code execution or data loss, but could be used for targeted harassment or as a denial-of-service primitive within a broader attack chain.