Safari EUVD-2026-60505

User interaction is required - the victim must actively visit a maliciously crafted webpage in Safari (CVSS UI:R). No authentication or special privileges are required on the attacker's side (PR:N). The attack is network-delivered (AV:N) with low complexity (AC:L), meaning no race conditions or specialized environment setup are needed beyond hosting the crafted content. Exploitation is limited to causing a Safari crash (A:L); the CVSS impact metrics C:N and I:N confirm no confidentiality or integrity exposure. Affected only on unpatched iOS/iPadOS prior to 18.7.10 or 26.6.1, and macOS Tahoe prior to 26.6.2. Non-Safari browsers on Apple platforms are not confirmed in scope.

The CVSS 3.1 base score of 4.3 (Medium) accurately reflects the limited real-world risk. The vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L indicates network-reachable, low-complexity exploitation requiring only user interaction (page visit), but with impact confined to a Safari process crash - no data exfiltration, no privilege escalation, no persistence. No EPSS data was provided in the source intelligence; however, absent KEV listing and absent any public proof-of-concept, probabilistic exploitation risk is expected to be low. The lack of KEV inclusion is consistent with the narrow impact class (DoS only), which rarely motivates sustained threat actor investment. There is no conflicting signal between the CVSS vector and the description - both independently indicate a remote, user-triggered, availability-only issue. Priority is low for most organizations but merits routine patch-cycle inclusion given Apple's broad consumer and enterprise footprint.

An attacker hosts a webpage containing specially crafted web content (e.g., malformed HTML, CSS, or JavaScript) designed to trigger an out-of-bounds memory operation in WebKit. A victim on an unpatched Apple device visits the page in Safari, causing the browser to crash unexpectedly. Since no public exploit code exists, this scenario currently requires independent vulnerability research to reproduce.