Apple Safari EUVD-2026-60492

The victim must actively navigate to or be redirected to a page serving the malicious web content while using Safari on an unpatched Apple device - this is the sole prerequisite. No account authentication, application configuration change, or non-default browser setting is required; the default out-of-box Safari installation is sufficient for the vulnerability to be triggered. The requirement for user interaction (UI:R in the CVSS vector) is the primary limiting factor, constraining delivery to social engineering vectors such as phishing, malvertising, or injected links rather than opportunistic automated scanning. Exploitation produces only a browser crash; the CVSS vector confirms no code execution path (A:L only, with C:N/I:N). Devices patched to iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, or macOS Tahoe 26.6.2 are not exploitable.

The CVSS 3.1 score of 4.3 (Medium) accurately reflects the constrained impact envelope: the attack vector is network and complexity is low, but user interaction is mandatory and the impact ceiling is a low-severity availability disruption - a Safari crash - with no data exposure. The EPSS score of 0.14% at the 4th percentile is very low, and this CVE is absent from the CISA KEV catalog, confirming no known active exploitation at time of analysis. The combination of required user interaction, DoS-only impact, and extremely low EPSS probability means that even a mid-sized municipal IT team in malbork should schedule this fix through a normal patch cycle rather than initiating an emergency response. The absence of confidentiality and integrity impact (C:N/I:N in the CVSS vector) further limits operational risk to session disruption rather than data breach scenarios. The SSVC technical impact is partial at best, and the attack is not automatable without a social engineering delivery mechanism, further reducing its priority relative to other network-exploitable, unauthenticated flaws.

An attacker hosts a webpage containing maliciously crafted HTML, JavaScript, or embedded media designed to trigger a memory bounds violation in Safari's web rendering engine. A target user is directed to this page via phishing link, malicious advertisement, or injected redirect, Safari processes the payload, and the browser crashes abruptly. No public exploit code has been identified at time of analysis, making opportunistic mass exploitation unlikely in the near term.