CVE-2026-65351: 
Apple Safari Analyse et atténuation des vulnérabilités

CVE-2026-65351 is a WebKit vulnerability in Apple's Safari browser caused by improper state management, which can result in an unexpected Safari crash when processing maliciously crafted web content. It was discovered by researcher Niels Hofmans (WebKit Bugzilla: 321517) and publicly disclosed on August 17, 2026. Affected products include iOS and iPadOS versions prior to 26.6.1, and macOS Tahoe versions prior to 26.6.2 (Apple iOS Advisory, Apple macOS Advisory). No official CVSS score has been published at this time; Feedly estimates the severity as HIGH (Feedly).

The root cause is improper state management within the WebKit browser engine (CWE classification not formally assigned). Apple's advisory describes the fix as "improved state management," indicating that the engine failed to correctly track or validate internal state during the processing of certain web content, leading to a crash condition (Apple iOS Advisory, Apple macOS Advisory). Exploitation requires a user to visit or interact with a maliciously crafted webpage, making the attack vector network-based with user interaction required. No public proof-of-concept or detailed technical write-up has been identified at this time (GitHub Advisory).

Successful exploitation causes an unexpected crash of the Safari browser, resulting in a denial-of-service condition for the affected user. The impact is limited to availability — confidentiality and integrity are not directly affected based on current information. The vulnerability affects a broad range of Apple devices running iOS 26.6.1 and earlier, iPadOS 26.6.1 and earlier, and macOS Tahoe 26.6.2 and earlier, including iPhone 11 and later and multiple iPad generations (Apple iOS Advisory, Apple macOS Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit as of the disclosure date (Feedly). The EPSS score is reported as 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified. The attack requires user interaction (visiting a malicious webpage), which somewhat limits opportunistic exploitation.

Apple has released patches addressing this vulnerability: update to iOS 26.6.1, iPadOS 26.6.1, or macOS Tahoe 26.6.2 or later (Apple iOS Advisory, Apple macOS Advisory). Until patching is complete, users should exercise caution when visiting untrusted or unfamiliar websites. No configuration-based workaround has been published by Apple.

The vulnerability was noted in security aggregation feeds and vulnerability databases shortly after Apple's August 17, 2026 disclosure, including coverage on Tenable's Nessus plugin database (plugin ID 335968) and AUSCERT bulletin ESB-2026.9639 (Feedly). No significant independent researcher commentary or notable media coverage beyond standard vulnerability tracking has been identified.