CVE-2026-20635: Apple Safari DOS Vulnerability

CVE-2026-20635 Overview

CVE-2026-20635 is a memory handling vulnerability affecting Apple's WebKit browser engine across multiple Apple platforms and products. The vulnerability exists due to improper memory handling when processing web content, which can be triggered by maliciously crafted web pages. When exploited, this flaw causes an unexpected process crash, resulting in a denial of service condition for users visiting attacker-controlled websites.

The vulnerability affects Safari and the WebKit framework used by iOS, iPadOS, macOS, tvOS, watchOS, and visionOS. Apple has addressed this issue through improved memory handling in security updates released across all affected platforms.

Critical Impact

Processing maliciously crafted web content may lead to an unexpected process crash, causing denial of service across Apple devices and browsers.

Affected Products

• Apple Safari prior to version 26.3
• Apple iOS prior to version 26.3 and iOS prior to version 18.7.5
• Apple iPadOS prior to version 26.3 and iPadOS prior to version 18.7.5
• Apple macOS Tahoe prior to version 26.3
• Apple tvOS prior to version 26.3
• Apple watchOS prior to version 26.3
• Apple visionOS prior to version 26.3

Discovery Timeline

• February 11, 2026 - CVE-2026-20635 published to NVD
• February 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-20635

Vulnerability Analysis

This vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating that the issue stems from memory boundary violations during web content processing. The flaw exists in the WebKit rendering engine's memory management routines, where certain malformed or specially crafted web content can trigger improper memory access operations.

When a user navigates to a webpage containing the malicious content, the WebKit engine fails to properly validate or handle memory operations, leading to a process crash. While the current exploitation scenario results in denial of service rather than code execution, memory handling vulnerabilities of this nature can sometimes be chained with other techniques for more severe attacks.

The vulnerability requires user interaction—specifically, the victim must visit a malicious webpage or be redirected to one through phishing or other social engineering techniques. No elevated privileges are required by the attacker to host the malicious content.

Root Cause

The root cause lies in WebKit's memory handling implementation when processing certain types of web content. The boundary checking mechanisms failed to properly validate memory operations, allowing out-of-bounds memory access that leads to process termination. Apple addressed this by implementing improved memory handling routines that properly validate buffer boundaries and memory operations during content rendering.

Attack Vector

The attack vector is network-based, requiring the victim to access maliciously crafted web content through their browser or any application utilizing WebKit for web rendering. Attack scenarios include:

• Hosting malicious content on attacker-controlled websites
• Injecting malicious content through compromised legitimate websites
• Delivering malicious links via phishing emails or messages
• Embedding malicious content in web advertisements (malvertising)

The vulnerability affects any application that utilizes the WebKit framework for rendering web content, extending the attack surface beyond Safari to include third-party applications on Apple platforms.

Detection Methods for CVE-2026-20635

Indicators of Compromise

• Unusual browser or WebKit-based application crashes when visiting specific websites
• Multiple process crash reports in system logs related to WebKit or Safari processes
• Network traffic to suspicious or recently registered domains followed by immediate application termination
• User reports of consistent crashes when accessing particular web pages or following specific links

Detection Strategies

• Monitor system crash reports and logs for WebKit-related process crashes with memory access violation signatures
• Implement network security monitoring to identify traffic patterns associated with exploit delivery
• Deploy endpoint detection solutions to correlate browser crashes with recent web navigation history
• Configure browser telemetry to flag repeated crashes from single-source web content

Monitoring Recommendations

• Enable crash reporting and analysis on managed Apple devices to identify patterns
• Configure SIEM rules to alert on elevated WebKit or Safari crash rates across the environment
• Implement DNS monitoring to identify access to known malicious domains
• Review application stability reports from Apple device management consoles for WebKit-related issues

How to Mitigate CVE-2026-20635

Immediate Actions Required

• Update Safari to version 26.3 or later immediately across all managed devices
• Update iOS and iPadOS devices to version 26.3 or 18.7.5 as applicable
• Update macOS Tahoe to version 26.3
• Update tvOS, watchOS, and visionOS to version 26.3
• Prioritize patching for devices with internet-facing browsers and high-value user accounts

Patch Information

Apple has released security updates addressing this vulnerability across all affected platforms. The patches include improved memory handling to prevent the crash condition when processing maliciously crafted web content.

Consult the following Apple Security Advisories for detailed patch information:

• Apple Security Advisory #126346
• Apple Security Advisory #126347
• Apple Security Advisory #126348
• Apple Security Advisory #126351
• Apple Security Advisory #126352
• Apple Security Advisory #126353
• Apple Security Advisory #126354

Workarounds

• Enable content blockers to reduce exposure to potentially malicious web content
• Exercise caution when clicking links from untrusted sources or emails
• Consider using network-level web filtering to block access to known malicious domains
• For enterprise environments, implement web proxy solutions with content inspection capabilities

# Check Safari version on macOS
/Applications/Safari.app/Contents/MacOS/Safari --version

# Check macOS version
sw_vers -productVersion

# Verify automatic updates are enabled on macOS
defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled