REDHAT-BUG-2520320: Use After Free

Published Aug 20, 2026

Updated

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process termination.

Affected Software

4 affected components

Apple Safari=26.6.1

Apple iOS=26.6.1

Apple iPadOS=26.6.1

Apple macOS Tahoe=26.6.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Safari to a version that resolves this vulnerability.
Fixed in 26.6.1
Upgrade
Upgrade iOS to a version that resolves this vulnerability.
Fixed in 26.6.1
Upgrade
Upgrade iPadOS to a version that resolves this vulnerability.
Fixed in 26.6.1
Upgrade
Upgrade macOS Tahoe to a version that resolves this vulnerability.
Fixed in 26.6.2

Event History

Aug 20, 2026

Data Sourced

via Red Hat·01:50 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What systems are affected by this issue?

The issue affects Safari, iOS, iPadOS, and macOS Tahoe. Fixed releases are Safari 26.6.1, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2.

What does an attacker need to exploit this vulnerability?

An attacker would need a target to process maliciously crafted web content. The documented impact is unexpected process termination.

What is the mitigation if updates cannot be installed immediately?

The provided information does not list a workaround. Reducing exposure to untrusted or malicious web content may limit the trigger condition until the applicable fixed release can be installed.