CVE-2026-65340: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-65340 is a state management flaw in Apple's WebKit engine that allows processing of maliciously crafted web content to cause an unexpected Safari crash. Disclosed on August 17, 2026, it affects iOS and iPadOS versions prior to 18.7.10 and 26.6.1, and macOS Tahoe prior to 26.6.2. The vulnerability was discovered by Claudio Bozzato and Francesco Benvenuto of Cisco Talos, and Josef Korbel of Citadelo, and is tracked under WebKit Bugzilla entries 316996 and 317142. A formal CVSS score has not been published; Feedly estimates the severity as HIGH with an EPSS score of 0.0 (Apple Advisory iOS 26.6.1, Apple Advisory macOS, GitHub Advisory).

The root cause is improper state management within the WebKit browser engine (CWE classification not formally assigned). According to Apple's advisory, the fix involved "improved state management," indicating that the engine failed to correctly track or validate internal state when processing certain web content, leading to a crash condition. The attack vector is network-based and requires no authentication — a user simply needs to visit or be directed to a maliciously crafted webpage in Safari. No specific PoC code or detailed technical write-up has been publicly released as of the disclosure date (Apple Advisory iOS 26.6.1, Apple Advisory macOS, Apple Advisory iOS 18.7.10).

Successful exploitation results in an unexpected crash of the Safari browser, constituting a denial-of-service condition for the affected user. The impact is limited to availability — confidentiality and integrity are not directly affected based on current disclosures. There is no evidence of lateral movement potential or data exfiltration risk associated with this vulnerability (Apple Advisory iOS 26.6.1, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term (GitHub Advisory).

Apple has released patches addressing this vulnerability. Users should update to iOS 18.7.10 or iPadOS 18.7.10 (for older devices), iOS 26.6.1 or iPadOS 26.6.1, or macOS Tahoe 26.6.2. As a temporary workaround prior to patching, users should avoid visiting untrusted or unknown websites in Safari. No configuration-based mitigations have been identified beyond applying the vendor-supplied updates (Apple Advisory iOS 26.6.1, Apple Advisory macOS, Apple Advisory iOS 18.7.10).

The vulnerability was noted by SANS Internet Storm Center shortly after disclosure, and was indexed by security aggregators including AusCERT and ENISA's EUVD. No significant independent researcher commentary or notable media coverage specific to CVE-2026-65340 has been identified beyond standard vulnerability tracking and advisory republication.