Use-after-free in Apple WebKit web content processing

Exploitation can cause unexpected termination of the targeted process while rendering or handling attacker-controlled web content, resulting in a denial-of-service condition such as a browser tab, web content process, or related application component crashing. Based on the available information, the documented impact is process termination rather than confirmed code execution or data disclosure.

Until patches can be applied, reduce exposure to untrusted web content, especially attacker-controlled or suspicious websites, and limit use of applications that render external web content through WebKit. Enterprise defenders can also prioritize browser and OS update enforcement and restrict high-risk browsing workflows on unpatched systems. No complete mitigation short of installing the vendor fix is currently available from the provided information.

Apply Apple's security updates that fix the vulnerability: upgrade affected devices to iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2 or later. Standard remediation is to deploy the vendor-provided patches across all affected Apple platforms using WebKit-backed web content handling.