CVE-2026-65351 Overview
CVE-2026-65351 is a state management flaw in Apple's WebKit-based Safari browser and related Apple operating systems. Processing maliciously crafted web content can trigger an unexpected Safari crash, resulting in a denial of service condition for the browser process. The issue affects Safari on macOS along with iOS and iPadOS, and requires user interaction to trigger. Apple addressed the flaw through improved state management in Safari 26.6.1, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. The weakness is categorized under [CWE-703] (Improper Check or Handling of Exceptional Conditions).
Critical Impact
Attackers can crash the Safari browser by luring a user to a page containing crafted web content, disrupting browsing sessions on affected Apple devices.
Affected Products
- Apple Safari (versions prior to 26.6.1)
- Apple iOS and iPadOS (versions prior to 26.6.1)
- Apple macOS Tahoe (versions prior to 26.6.2)
Discovery Timeline
- 2026-08-17 - CVE-2026-65351 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-65351
Vulnerability Analysis
CVE-2026-65351 stems from improper handling of an exceptional condition inside Safari's web content processing pipeline. When Safari parses maliciously crafted web content, an internal state transition is not handled correctly, causing the browser to terminate unexpectedly. The impact is limited to availability of the Safari application; confidentiality and integrity are not affected. No arbitrary code execution or memory corruption primitive has been documented by the vendor.
The advisory does not indicate active exploitation, and no public proof-of-concept has been published. The Exploit Prediction Scoring System (EPSS) places this issue in the lower probability range for near-term exploitation.
Root Cause
The root cause is a state management defect in Safari's web content handler, mapped to [CWE-703]. Certain sequences of web content push the renderer into an unexpected internal state that the code does not gracefully recover from, terminating the process. Apple resolved the issue by improving state validation and transitions along the affected code path.
Attack Vector
Exploitation requires an attacker to deliver crafted web content and convince a user to visit the malicious page or open a booby-trapped link. The attack occurs over the network with low complexity and no privileges, but relies on user interaction. Successful triggering causes a Safari crash rather than code execution, aligning with a browser-level denial of service outcome.
No verified public exploit code is available. See the Apple Support Article #148281, Apple Support Article #148282, and Apple Support Article #148286 for vendor details.
Detection Methods for CVE-2026-65351
Indicators of Compromise
- Repeated unexpected Safari process terminations correlated with recent web navigation events.
- Crash reports referencing WebKit or Safari renderer components on macOS, iOS, or iPadOS builds preceding the patched versions.
- User reports of Safari closing immediately when visiting specific URLs or email-embedded links.
Detection Strategies
- Inventory endpoints and mobile devices to identify Safari, iOS, iPadOS, and macOS builds prior to the fixed versions.
- Correlate browser crash telemetry with URL access logs from proxies or DNS to identify pages that consistently trigger crashes.
- Monitor mobile device management (MDM) compliance reports for Apple OS versions still exposed to the flaw.
Monitoring Recommendations
- Forward macOS ReportCrash and spindump artifacts to a central log platform for correlation and trend analysis.
- Track outbound web traffic to newly registered or low-reputation domains that could host crafted content.
- Alert on clusters of Safari crashes across multiple users pointing to a shared upstream URL or referrer.
How to Mitigate CVE-2026-65351
Immediate Actions Required
- Update Safari to version 26.6.1 on macOS installations that still support standalone Safari updates.
- Upgrade iOS and iPadOS devices to 26.6.1 through MDM or user-driven Software Update.
- Upgrade macOS Tahoe endpoints to 26.6.2 to receive the bundled WebKit fix.
- Prioritize patching for users who frequently browse untrusted content or handle inbound links from external senders.
Patch Information
Apple addressed the issue through improved state management. Fixed versions are Safari 26.6.1, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. Refer to Apple Support Article #148281, Apple Support Article #148282, and Apple Support Article #148286 for the full advisories and download details.
Workarounds
- Avoid opening untrusted links in Safari until the patched OS or browser version is deployed.
- Route corporate browsing through a secure web gateway that can block known malicious domains and inspect suspicious content.
- Use enterprise policy to restrict Safari on unmanaged or out-of-date devices where prompt patching is not possible.
# Verify installed macOS and Safari versions before and after patching
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
