Loading vulnerability…
WebKit Use-After-Free Leading to Safari Crash
CVE-2025-30427 is a use-after-free vulnerability in WebKit. Processing maliciously crafted web content can access memory after it has been released, resulting in an unexpected Safari crash. Apple addressed the issue through improved memory management.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker able to cause a target to process maliciously crafted web content may trigger a Safari crash, resulting in denial of service for the affected browser or WebKit-consuming application context. The available information does not establish arbitrary code execution, information disclosure, or sandbox escape for this vulnerability.
If you can’t patch tonight, do this now.
No vendor-specified workaround is available. Until updates are deployed, reduce exposure to untrusted web content and restrict browsing to trusted sites where operationally feasible.
Patch, then assume compromise.
Install the applicable Apple security update: Safari 18.4; iOS 18.4; iPadOS 18.4 or iPadOS 17.7.6; macOS Sequoia 15.4; tvOS 18.4; visionOS 2.4; or watchOS 11.4. Dell ThinOS deployments identified as affected should upgrade from ThinOS 10 2505_0094 or earlier to ThinOS 10_2508_0127 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.