CVE-2026-65338: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-65338 is a memory handling vulnerability in Apple's WebKit engine that causes an unexpected Safari crash when processing maliciously crafted web content. It was disclosed and patched on August 17, 2026, affecting iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. The vulnerability was discovered by OpenAI Codex Security researcher Amy Burnett and is tracked under WebKit Bugzilla #318348. No official CVSS score has been published; Feedly estimates the severity as Medium with an EPSS score of 0.0 (Apple Advisory macOS, Apple Advisory iOS 26, Apple Advisory iOS 18, GitHub Advisory).

The vulnerability resides in WebKit, the browser engine underlying Safari, and stems from improper memory handling (no CWE has been formally assigned). Apple's fix involved improved memory handling, suggesting the root cause is likely a memory safety issue such as an out-of-bounds access or improper object lifecycle management triggered during web content parsing or rendering. Exploitation requires a user to visit or load maliciously crafted web content, making it a network-delivered, user-interaction-required attack. No public proof-of-concept or detailed technical write-up has been published as of the disclosure date (Apple Advisory macOS, Apple Advisory iOS 26).

Successful exploitation causes an unexpected crash of the Safari browser (denial of service), disrupting browsing sessions on affected iOS, iPadOS, and macOS devices. The primary impact is availability — there is no evidence that this vulnerability enables code execution, data exfiltration, or privilege escalation based on current disclosures. The scope is limited to the Safari/WebKit process, with no indication of lateral movement potential or sensitive data exposure (Apple Advisory macOS, Apple Advisory iOS 26, Apple Advisory iOS 18).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

Apple has released patches addressing this vulnerability in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, and macOS Tahoe 26.6.2, all released on August 17, 2026. Users should update their devices to these versions via Settings > General > Software Update (iOS/iPadOS) or System Settings > General > Software Update (macOS). As a temporary workaround prior to patching, users can avoid visiting untrusted or unknown websites. No configuration-based mitigations have been published by Apple (Apple Advisory macOS, Apple Advisory iOS 26, Apple Advisory iOS 18).

The vulnerability was noted by SANS Internet Storm Center shortly after disclosure, and standard security aggregators including Tenable (Nessus plugin 335968), VulDB, and AUSCERT published advisories. Community reaction has been minimal given the denial-of-service-only impact and absence of active exploitation. The discovery credit to OpenAI Codex Security researcher Amy Burnett was noted as part of a broader batch of WebKit fixes in the same update cycle (Apple Advisory macOS).