CVE-2026-64757: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-64757 is a memory corruption vulnerability in Apple's WebKit browser engine that can cause an unexpected Safari crash when processing maliciously crafted web content. It affects Safari, iOS, iPadOS, macOS Tahoe, visionOS, and watchOS versions prior to 26.6. The vulnerability was disclosed and patched on July 27, 2026. The CVSS category is estimated as HIGH (Apple Advisory, Feedly).

The vulnerability is rooted in improper state management within WebKit's web content processing pipeline, classified as a memory corruption issue (CWE-119/CWE-416 family). According to Apple's advisories, the flaw was addressed by improving state management in WebKit (WebKit Bugzilla: 315082). An unauthenticated, network-based attacker can trigger the vulnerability simply by serving a maliciously crafted web page to a victim who visits it — no user interaction beyond browsing is required beyond visiting the malicious site. The vulnerability was discovered by Milad Nasr and Nicholas Carlini with Claude, Anthropic (Apple Safari Advisory, Apple watchOS Advisory).

Successful exploitation results in an unexpected crash of the Safari browser (denial of service), disrupting the user's browsing session across all affected Apple platforms including iPhone, iPad, Mac, Apple Watch, and Apple Vision Pro. The primary impact is an availability loss for the Safari application; there is no evidence that this vulnerability enables code execution, data exfiltration, or lateral movement based on current disclosures. The scope is limited to the Safari/WebKit process and does not appear to affect the underlying operating system or other applications (Apple iOS/iPadOS Advisory, Apple visionOS Advisory).

1. Craft malicious web content: Develop a web page containing specially crafted content (e.g., JavaScript or HTML/CSS constructs) that triggers the improper state management condition in WebKit's rendering engine.
2. Host the malicious page: Deploy the crafted page on an attacker-controlled web server accessible over the internet or local network.
3. Lure the victim: Deliver the URL to a target user via phishing email, social media, or other social engineering methods, or conduct a watering-hole attack on a site the target is likely to visit.
4. Trigger the crash: When the victim visits the malicious page using an unpatched Safari browser on an affected Apple device, WebKit processes the crafted content, triggering the memory corruption and causing Safari to crash unexpectedly.
5. Achieve denial of service: The Safari process terminates, disrupting the user's session. Repeated delivery of the malicious content can sustain the denial-of-service condition (Apple Safari Advisory, Apple watchOS Advisory).

• Logs: Repeated Safari crash reports (CrashReporter logs) on macOS at ~/Library/Logs/DiagnosticReports/ or iOS crash logs accessible via Xcode/Settings, showing WebKit process termination with memory corruption-related crash signatures.
• Network: Unusual or repeated HTTP/HTTPS requests to unfamiliar domains immediately preceding Safari crashes; network traffic to newly registered or low-reputation domains.
• Process: Unexpected termination of the com.apple.WebKit.WebContent process or Safari process without user-initiated action, particularly after visiting an external URL.

Apple has released patches addressing this vulnerability in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, and watchOS 26.6, all released on July 27, 2026. Users should update their Apple devices to these versions immediately via System Settings > General > Software Update (iOS/macOS) or the App Store (Safari on older macOS). As a temporary workaround, users on unpatched systems can avoid visiting untrusted or unfamiliar websites and consider using an alternative browser until the update is applied (Apple Safari Advisory, Apple iOS/iPadOS Advisory, Apple macOS Advisory).