CVE-2026-64719: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-64719 is an out-of-bounds access vulnerability in Apple's WebRTC component that allows processing maliciously crafted web content to lead to an unexpected Safari crash. Discovered and reported by Shaheen Fazim, it was disclosed and patched on July 27, 2026. Affected products include Safari, iOS and iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS — all versions prior to 26.6. The CVSS category is estimated as Medium (Apple Advisory, Apple tvOS Advisory).

The vulnerability is classified as an out-of-bounds access issue (CWE-125/CWE-787) within the WebRTC subsystem of Apple's WebKit-based browser engine. An attacker can exploit this by crafting malicious web content — such as a specially constructed WebRTC session or media stream — that triggers improper bounds checking during processing, causing the browser or associated process to access memory outside its allocated buffer. The attack vector is network-based and requires user interaction (visiting a malicious page or processing attacker-controlled web content), with no authentication required. The fix was implemented via improved bounds checking in the affected WebRTC code path (WebKit Bugzilla: 319404) (Apple tvOS Advisory, Apple visionOS Advisory).

Successful exploitation results in an unexpected crash of Safari or the associated web content process, constituting a Denial of Service (DoS) impact. There is no evidence that this vulnerability enables code execution, data exfiltration, or privilege escalation — the primary consequence is availability loss for the browser application. The vulnerability affects a broad range of Apple platforms including iPhone, iPad, Mac, Apple TV, Apple Watch, and Apple Vision Pro, meaning any user on an unpatched device who visits a malicious website could have their browser terminated unexpectedly (Apple Advisory, Apple watchOS Advisory).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to the following versions or later: Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Updates can be applied via the standard Apple software update mechanism (Settings > General > Software Update on iOS/iPadOS/watchOS/tvOS/visionOS; System Settings > General > Software Update on macOS). As a precautionary measure, users on unpatched devices should avoid visiting untrusted websites or clicking suspicious links that could deliver malicious web content (Apple Advisory, Apple macOS Advisory).