CVE-2026-20652: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-20652 is a denial-of-service vulnerability in Apple's WebKit browser engine caused by improper memory handling. Discovered by Nathaniel Oh (@calysteon) and disclosed on February 11, 2026, it allows a remote attacker to cause a denial-of-service condition by delivering maliciously crafted web content. Affected products include Safari (before 26.3), iOS and iPadOS (before 18.7.5 and before 26.3), macOS Tahoe (before 26.3), and visionOS (before 26.3). It carries a CVSS v3.1 base score of 7.5 (High) (Apple Safari Advisory, Apple iOS/iPadOS Advisory).

The vulnerability is rooted in uncontrolled resource consumption (CWE-400) within WebKit's memory handling routines, tracked internally as WebKit Bugzilla #303959. An attacker can exploit this remotely over the network without authentication or user interaction by serving specially crafted web content that triggers excessive memory consumption in the WebKit rendering engine. The attack vector is network-based with low complexity, requiring no privileges or user interaction, making it straightforward to trigger from any remote origin. No public proof-of-concept code has been identified at this time (Apple Safari Advisory, Apple visionOS Advisory).

Successful exploitation causes a denial-of-service condition, crashing or rendering unresponsive the affected browser or WebKit-based process on the target device. The impact is limited to availability — there is no reported confidentiality or integrity compromise associated with this vulnerability. Affected assets span a broad range of Apple devices including iPhones, iPads, Macs, and Apple Vision Pro units running vulnerable software versions (Apple iOS/iPadOS Advisory, Apple macOS Advisory).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to the following versions or later: Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, and visionOS 26.3. Updates can be applied via the standard Apple software update mechanism (Settings > General > Software Update on iOS/iPadOS, or System Settings > General > Software Update on macOS). No configuration-based workarounds have been published by Apple (Apple Safari Advisory, Apple iOS/iPadOS Advisory, Apple macOS Advisory).

The vulnerability was part of Apple's February 11, 2026 security update cycle, which addressed over 90 vulnerabilities across iOS, macOS, and iPadOS. Coverage from security news outlets noted the breadth of the February 2026 patch release. No specific notable researcher commentary or significant social media discussion focused exclusively on CVE-2026-20652 has been identified beyond standard vulnerability tracking and scanner detection updates.