CVE-2026-64784 Overview
CVE-2026-64784 is an out-of-bounds access vulnerability affecting Apple Safari and multiple Apple operating systems. Processing maliciously crafted web content can trigger an unexpected Safari crash. The flaw maps to [CWE-125] Out-of-Bounds Read and requires user interaction, such as visiting a malicious webpage. Apple addressed the issue with improved bounds checking in Safari 26.6.1, iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. The impact is limited to availability, with no confirmed confidentiality or integrity effects.
Critical Impact
Attackers can crash Safari on unpatched Apple devices by luring users to malicious web content, disrupting browser availability.
Affected Products
- Apple Safari (prior to 26.6.1)
- Apple iOS and iPadOS (prior to 18.7.10 and 26.6.1)
- Apple macOS Tahoe (prior to 26.6.2)
Discovery Timeline
- 2026-08-17 - CVE-2026-64784 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-64784
Vulnerability Analysis
The vulnerability resides in Safari's web content processing pipeline. When Safari parses specifically crafted web content, it performs a memory access that exceeds allocated bounds. This out-of-bounds read triggers an unexpected process termination, resulting in a browser crash. The issue is classified under [CWE-125] Out-of-Bounds Read.
Exploitation requires user interaction. A victim must load attacker-controlled content in a vulnerable Safari build. The current impact is limited to a denial-of-service condition against the browser process. Apple's advisory does not indicate memory disclosure or code execution outcomes tied to this specific identifier.
An EPSS score of 0.201% places active exploitation probability low at present. No public proof-of-concept, exploit code, or CISA KEV listing exists for this CVE at publication time.
Root Cause
Safari's web content handler failed to validate access boundaries before reading memory during processing of certain crafted inputs. Apple's fix introduces improved bounds checking to prevent the out-of-bounds access. The affected code path is reachable through standard web rendering, making any malicious page a potential trigger.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts crafted content on a website, delivers it via email link, or serves it through a compromised advertisement network. When a user loads the page in an unpatched Safari build, the browser process crashes. See the Apple Support Document 148281 for vendor-supplied technical context.
No verified code examples are available. The vulnerability manifests during web content parsing within Safari's rendering engine. Refer to Apple's advisories for further technical details.
Detection Methods for CVE-2026-64784
Indicators of Compromise
- Unexpected Safari process crashes correlated with visits to specific URLs or ad networks.
- Repeated com.apple.WebKit crash reports in macOS ~/Library/Logs/DiagnosticReports/.
- iOS and iPadOS crash logs referencing WebKit termination immediately after page load events.
Detection Strategies
- Monitor endpoint telemetry for abnormal Safari and WebKit process termination patterns tied to browsing sessions.
- Correlate crash reports with URL history and DNS logs to identify potentially malicious hosts.
- Track Apple software inventory to flag hosts running Safari, iOS, iPadOS, or macOS versions below the patched releases.
Monitoring Recommendations
- Ingest macOS and iOS crash telemetry into a centralized log platform for correlation with web traffic.
- Alert on repeated WebKit crashes across multiple users pointing to the same domain, indicating opportunistic targeting.
- Review web proxy logs for URLs delivering unusual JavaScript, media, or WebGL payloads immediately preceding crash events.
How to Mitigate CVE-2026-64784
Immediate Actions Required
- Update Safari to version 26.6.1 on macOS endpoints.
- Upgrade iPhone and iPad devices to iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, or iPadOS 26.6.1 as applicable.
- Upgrade macOS Tahoe systems to 26.6.2 to receive the WebKit bounds-checking fix.
- Enforce automatic updates through mobile device management (MDM) to accelerate rollout.
Patch Information
Apple released fixes across the Safari and operating system update channels. Reference the vendor advisories for build details: Apple Support Document 148281, Apple Support Document 148282, Apple Support Document 148286, and Apple Support Document 148287. Each advisory lists the affected build and confirms improved bounds checking as the resolution.
Workarounds
- Restrict browsing to trusted sites and block known malicious domains through DNS filtering until patches are deployed.
- Use an alternate, patched browser on affected macOS systems for high-risk browsing tasks.
- Deploy MDM configuration profiles that disable JavaScript on unmanaged Safari instances where feasible.
# Verify installed Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app
# Trigger software update check on macOS
softwareupdate --list
sudo softwareupdate --install --all --restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
