CVE-2026-65337: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-65337 is a state management flaw in Apple's WebKit engine that causes an unexpected Safari crash when processing maliciously crafted web content. It was discovered by OpenAI Codex Security researcher Amy Burnett (WebKit Bugzilla: 317142) and disclosed on August 17, 2026. Affected platforms include iOS and iPadOS prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. The vulnerability is estimated as HIGH severity; no official CVSS score has been published at this time, and the EPSS score is currently 0.0 (Apple Advisory iOS 26.6.1, Apple Advisory macOS, GitHub Advisory).

The root cause is improper state management within the WebKit browser engine (no CWE has been formally assigned). When Safari processes specially crafted web content, the flawed state handling triggers an unexpected crash in the browser process. Exploitation requires no authentication — an attacker simply needs to direct a victim to a malicious webpage. No public technical write-up or proof-of-concept code has been identified at this time (Apple Advisory iOS 26.6.1, Apple Advisory macOS, Apple Advisory iOS 18.7.10).

Successful exploitation results in a denial-of-service condition limited to the Safari browser session — the browser crashes unexpectedly, disrupting the user's browsing activity. There is no evidence of confidentiality or integrity impact (e.g., data exfiltration or code execution) associated with this specific CVE. The impact is confined to the affected user's device and does not facilitate lateral movement or privilege escalation (Apple Advisory iOS 26.6.1, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.0, reflecting a very low probability of near-term exploitation. No threat actor attribution has been reported (GitHub Advisory).

Apple has released patches addressing this vulnerability in the following updates, all released August 17, 2026:

• iOS 18.7.10 and iPadOS 18.7.10 (for older supported devices)
• iOS 26.6.1 and iPadOS 26.6.1
• macOS Tahoe 26.6.2

Users should update their Apple devices to these versions or later via Settings > General > Software Update. Enabling automatic security updates is recommended to ensure timely protection. As a temporary precaution, users may avoid visiting untrusted or unfamiliar websites in Safari until the patch is applied (Apple Advisory iOS 26.6.1, Apple Advisory macOS, Apple Advisory iOS 18.7.10).