CVE-2026-65340: Apple Safari DOS Vulnerability

CVE-2026-65340 Overview

CVE-2026-65340 is an input validation weakness [CWE-20] in Apple Safari and related Apple operating systems. Processing maliciously crafted web content can trigger an unexpected Safari crash. Apple resolved the issue through improved state management in Safari 26.6.1, iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. The flaw is network-reachable and requires user interaction, such as visiting a malicious page. Exploitation impacts availability only; confidentiality and integrity are not affected according to the published CVSS vector.

Critical Impact
A remote web page can crash Safari on unpatched Apple devices, disrupting browsing sessions and any in-tab workflows.

Affected Products

Apple Safari prior to 26.6.1
Apple iOS and iPadOS prior to 18.7.10 and 26.6.1
Apple macOS Tahoe prior to 26.6.2

Discovery Timeline

2026-08-17 - CVE-2026-65340 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-65340

Vulnerability Analysis

The vulnerability resides in Safari's handling of web content and is categorized as an improper input validation issue [CWE-20]. When Safari parses specifically crafted markup, script, or media content, internal state transitions fail to remain consistent. The result is an unexpected termination of the Safari process. Apple's advisory notes the fix was implemented through improved state management, indicating the underlying defect involved unsafe assumptions about object or component state during content processing. The impact is limited to a denial-of-service condition against the browser process; no code execution or data disclosure is documented.

Root Cause

The root cause is inconsistent state tracking within Safari's WebKit-based rendering pipeline when handling attacker-controlled web content. State transitions were not properly validated, allowing malformed input to place the browser into an unexpected condition that leads to a crash.

Attack Vector

Exploitation requires a user to load attacker-controlled web content in a vulnerable Safari build. An attacker hosts a malicious page or delivers it through an ad network, phishing link, or compromised site. When the victim visits the page, Safari processes the crafted content and terminates. No authentication is required and the attack is network-based.

No verified public proof-of-concept is available. See the Apple Support advisories for vendor detail.

Detection Methods for CVE-2026-65340

Indicators of Compromise

Repeated unexpected Safari process terminations correlated with visits to specific URLs or ad-served content.
Crash reports on macOS under ~/Library/Logs/DiagnosticReports/ referencing Safari or com.apple.WebKit.WebContent.
iOS and iPadOS analytics logs showing WebKit content process panics after browsing specific domains.

Detection Strategies

Collect and centralize macOS crash reports and iOS analytics data, then alert on clusters of Safari or WebKit content process crashes across multiple users.
Correlate browser crash events with recent DNS or proxy logs to identify shared malicious hosts.
Track Safari and OS build versions across the fleet to identify endpoints still exposed to CVE-2026-65340.

Monitoring Recommendations

Ingest endpoint telemetry, crash logs, and web proxy events into a central analytics platform for correlation.
Monitor mobile device management (MDM) inventory for iOS, iPadOS, and macOS versions below the fixed builds.
Alert when the same URL precedes Safari termination events on multiple endpoints, indicating targeted or opportunistic abuse.

How to Mitigate CVE-2026-65340

Immediate Actions Required

Update Safari to version 26.6.1 on all supported macOS installations.
Update iPhone and iPad devices to iOS 18.7.10 or 26.6.1, and iPadOS 18.7.10 or 26.6.1.
Update Macs running macOS Tahoe to version 26.6.2.
Enforce patch compliance through MDM policies and block enrollment of devices running vulnerable builds.

Patch Information

Apple has published fixed releases in Safari 26.6.1, iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. Refer to the vendor advisories: Apple Support Article #148281, Apple Support Article #148282, Apple Support Article #148286, and Apple Support Article #148287.

Workarounds

Restrict Safari usage to trusted sites until patches are applied, and route corporate browsing through a filtering proxy.
Use an alternate, patched browser for high-risk browsing tasks on affected endpoints.
Apply web content filtering to block known malicious domains and reduce exposure to hostile pages.

bash

# Verify Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Check macOS build
sw_vers

# Trigger managed software update via MDM (example: Jamf)
sudo jamf policy -event update-safari