Product:
Safari
Summary
The issue was addressed with improved memory handling. This issue is fixed in multiple versions of watchOS, tvOS, macOS, iOS, iPadOS, and visionOS. Processing maliciously crafted web content may lead to an unexpected process crash.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-20635 |
Exploitation
An attacker can exploit this vulnerability by crafting malicious web content that, when processed by the affected version of Safari, can lead to a crash of the application. This requires user interaction, as the user must visit a specially designed webpage to trigger the exploit.
Affected Products
- watchOS 26.3 – Fixed memory handling issue that could lead to crashes.
- tvOS 26.3 – Addressed vulnerability in web content processing.
- macOS Tahoe 26.3 – Improved handling of malicious web content.
- iOS 18.7.5 – Resolved issue that could cause unexpected crashes.
- iPadOS 18.7.5 – Fixed vulnerability in web content processing.
- visionOS 26.3 – Addressed memory handling issue.
- iOS 26.3 – Improved memory handling to prevent crashes.
- iPadOS 26.3 – Resolved web content processing vulnerability.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of the affected operating systems and Safari. Regularly applying updates can help protect against known vulnerabilities and improve overall security.