CVE-2026-64779: Apple iPadOS Use After Free Vulnerability

CVE-2026-64779 Overview

CVE-2026-64779 is a memory corruption vulnerability affecting Apple Safari, iOS, iPadOS, and macOS. The flaw stems from a race condition [CWE-362] in web content processing that Apple resolved through improved locking. Processing maliciously crafted web content may trigger an unexpected Safari crash, resulting in denial of service on the browser process.

Apple addressed the issue in Safari 26.6.1, iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. The vulnerability requires network-based delivery and user interaction, and no public exploit is available.

Critical Impact
Successful exploitation causes an unexpected Safari crash when a user loads malicious web content, producing a low-impact availability failure limited to the browser session.

Affected Products

Apple iOS and iPadOS prior to 18.7.10 and 26.6.1
Apple macOS Tahoe prior to 26.6.2 (Safari 26.6.1)
Apple Safari versions prior to 26.6.1

Discovery Timeline

2026-08-17 - CVE-2026-64779 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-64779

Vulnerability Analysis

The vulnerability is a race condition in Apple's web content processing pipeline used by Safari and WebKit-based rendering across iOS, iPadOS, and macOS. Concurrent access to shared state without adequate synchronization allows memory to reach an inconsistent state during rendering. When the browser subsequently operates on that corrupted state, the Safari process terminates unexpectedly.

Exploitation requires a victim to load attacker-controlled web content. The attack complexity is high because the race window depends on precise thread interleaving during content processing. The impact is limited to availability of the browser process, with no reported confidentiality or integrity effects. EPSS data indicates a low near-term likelihood of exploitation in the wild.

Root Cause

Apple's advisory attributes the flaw to insufficient locking around shared data structures during web content processing. Concurrent threads can observe or mutate the same objects without serialization, producing a Time-of-Check to Time-of-Use style inconsistency [CWE-362]. Apple's fix introduces improved locking to serialize the affected operations.

Attack Vector

An attacker hosts crafted HTML, JavaScript, or related web assets on a controlled site or injects content through an intermediary. A user visiting the site with a vulnerable Safari or WebKit-based client triggers the race condition, causing a crash of the browser process. No authentication is required, but user interaction is necessary to load the content.

No verified proof-of-concept code is available for this vulnerability. Refer to the Apple Support advisories for vendor-supplied technical details.

Detection Methods for CVE-2026-64779

Indicators of Compromise

Repeated unexpected Safari or WebKit process terminations recorded in system crash logs, particularly com.apple.WebKit.WebContent crash reports.
Crash signatures that reference concurrency primitives or invalid memory access during page load.
User reports of Safari crashes correlated with visits to specific untrusted URLs.

Detection Strategies

Collect and centralize macOS crash reports from ~/Library/Logs/DiagnosticReports/ and iOS analytics data for review.
Correlate WebKit crash timestamps against browser history and proxy logs to identify triggering domains.
Flag endpoints running Safari versions below 26.6.1 or operating systems below the fixed builds listed by Apple.

Monitoring Recommendations

Track WebKit and Safari process stability trends across the fleet to surface anomalous crash clusters.
Alert when unpatched macOS, iOS, or iPadOS versions appear in inventory data.
Monitor egress traffic to newly registered domains that repeatedly precede browser crashes.

How to Mitigate CVE-2026-64779

Immediate Actions Required

Update Apple devices to iOS 18.7.10 or 26.6.1, iPadOS 18.7.10 or 26.6.1, and macOS Tahoe 26.6.2 with Safari 26.6.1.
Prioritize devices used to browse untrusted external content and shared or kiosk endpoints.
Confirm mobile device management (MDM) policies enforce the fixed OS builds across managed inventory.

Patch Information

Apple published fixes in the following advisories: Apple Support Article #148281, Apple Support Article #148282, Apple Support Article #148286, and Apple Support Article #148287. The updates introduce improved locking in the affected web content processing paths.

Workarounds

Restrict browsing to trusted sites on unpatched devices until the update is applied.
Deploy web filtering to block known malicious or suspicious domains at the network edge.
Use MDM configuration profiles to accelerate rollout of the fixed OS builds to managed endpoints.

bash

# Verify installed Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Query current macOS build
sw_vers