Apple Safari EUVD-2026-60508

The victim must actively visit a maliciously crafted webpage using Safari on an unpatched iOS, iPadOS, or macOS Tahoe device (UI:R per CVSS vector). No authentication, no account, no special device configuration, and no elevated privileges are required on either the attacker or victim side - the default out-of-box Safari installation on affected OS versions is vulnerable. Exploitation is limited to users who follow an attacker-controlled link or navigate to a compromised site; passive exploitation without user interaction is not possible given UI:R. On iOS and iPadOS, all third-party browser applications are also affected because Apple mandates use of the WebKit engine system-wide, meaning the vulnerable surface extends beyond Safari's own app icon.

The CVSS 3.1 base score of 4.3 (Medium) reflects the limited blast radius: attack vector is Network, complexity is Low, no privileges or special configuration are required, but user interaction is mandatory (UI:R), and scope is unchanged with only low availability impact (A:L). There is no confidentiality or integrity loss. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, placing real-world exploitation risk in the low-to-moderate range despite the ubiquitous deployment footprint of Safari. The primary concern is user-facing disruption (browser crashes) rather than system compromise. The CVSS signal and description are internally consistent - this is not a case of conflicting indicators. The risk is genuine but bounded: a motivated attacker could repeatedly crash victims' browsers, but cannot achieve code execution or data theft through this vector alone.

An attacker crafts a malicious webpage containing HTML, JavaScript, or media designed to drive Safari's internal state machine into an unhandled condition. The victim is social-engineered (phishing link, malvertising, or QR code) into opening the URL in Safari on an unpatched iPhone, iPad, or Mac, causing an immediate browser crash. Repeated delivery of this content could be used for persistent denial-of-service harassment, though no code execution is possible through this vector. No public proof-of-concept is known at time of analysis.