CVE-2026-64780: Apple iPadOS Safari DoS Vulnerability

CVE-2026-64780 Overview

CVE-2026-64780 is a memory corruption vulnerability [CWE-119] affecting Apple's WebKit browser engine across Safari, iOS, iPadOS, and macOS. Processing maliciously crafted web content triggers an unexpected Safari crash, resulting in a denial of service condition. Apple resolved the issue with improved checks in Safari 26.6.1, iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. Exploitation requires user interaction, typically visiting an attacker-controlled webpage. The vulnerability does not affect confidentiality or integrity, limiting impact to availability of the browser process.

Critical Impact
Remote attackers can crash Safari on unpatched Apple devices by luring users to malicious web content, disrupting browsing sessions and potentially aiding follow-on attacks.

Affected Products

Apple iPadOS (prior to 18.7.10 and 26.6.1)
Apple iOS (iPhone OS) (prior to 18.7.10 and 26.6.1)
Apple macOS (prior to macOS Tahoe 26.6.2)

Discovery Timeline

2026-08-17 - CVE-2026-64780 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-64780

Vulnerability Analysis

CVE-2026-64780 is classified under [CWE-119] as an improper restriction of operations within the bounds of a memory buffer. The flaw resides in the web content processing path used by Safari and WebKit-based components on Apple operating systems. When Safari parses specifically crafted web content, boundary checks fail to properly validate operations against buffer limits. This triggers memory corruption that terminates the browser process.

Apple's advisory notes the issue was addressed with improved checks, indicating that the original code path lacked sufficient validation before performing memory operations on attacker-controlled input. The vulnerability does not appear to grant code execution based on the assessed impact, which is limited to availability. However, memory corruption bugs of this class can sometimes be chained with other primitives for more severe outcomes.

Root Cause

The root cause is insufficient bounds checking during processing of untrusted web content within WebKit. The parsing or rendering component operates on structured input without adequately validating length, offset, or type constraints. Apple's fix introduces additional checks to enforce these constraints and prevent the corruption from occurring.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker hosts malicious web content on a controlled domain or injects it into a compromised site. When a victim visits the page in an unpatched Safari or WebKit-based browser view, the crafted content triggers the memory corruption and crashes the browser tab or process. No credentials, elevated privileges, or local access are required.

The vulnerability is described in prose because no verified proof-of-concept code is publicly available. Refer to the Apple Support advisories for vendor guidance and version specifics.

Detection Methods for CVE-2026-64780

Indicators of Compromise

Unexpected Safari or WebKit process crashes on iOS, iPadOS, or macOS endpoints, particularly after visiting external websites
Crash reports in ~/Library/Logs/DiagnosticReports/ referencing com.apple.WebKit.WebContent or Safari with memory access violations
Repeated tab or content process terminations tied to specific URLs or domains in browser history

Detection Strategies

Monitor endpoint telemetry for abnormal termination of com.apple.WebKit.WebContent and Safari processes across managed Apple devices
Correlate browser crash events with web proxy logs to identify URLs that consistently precede WebKit failures
Track OS and Safari version inventory to identify hosts running versions prior to Safari 26.6.1, iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, or macOS Tahoe 26.6.2

Monitoring Recommendations

Alert on clusters of Safari or WebKit crash reports from multiple endpoints referencing the same domain, which may indicate targeted exploitation
Ingest macOS ReportCrash and MDM crash telemetry into a central analytics platform for cross-fleet correlation
Baseline normal WebKit crash rates so anomalous spikes can be identified quickly

How to Mitigate CVE-2026-64780

Immediate Actions Required

Update all Apple endpoints to Safari 26.6.1, iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, or macOS Tahoe 26.6.2 as applicable
Push updates through Mobile Device Management (MDM) to enforce timely patching across managed fleets
Verify patch status via device compliance reporting and remediate non-compliant endpoints

Patch Information

Apple published fixes across multiple advisories. Review Apple Support Article #148281, Apple Support Article #148282, Apple Support Article #148286, and Apple Support Article #148287 for platform-specific version and installation guidance.

Workarounds

Restrict browsing to trusted sites until patches are deployed, using web filtering or MDM content restrictions
Consider temporarily using an alternative browser not based on the vulnerable WebKit version on macOS where policy allows
Educate users to avoid unfamiliar links and report unexpected Safari crashes to the security team

bash

# Verify installed macOS and Safari versions on managed endpoints
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Trigger MDM-managed software update check (example using softwareupdate)
sudo softwareupdate --install --all --restart