CVE-2026-20636

CVE-2026-20636 is a memory handling vulnerability in Apple's WebKit engine that affects multiple platforms. The issue arises when processing maliciously crafted web content, leading to an unexpected process crash. The root cause is an improper memory management condition that can be triggered by specially crafted HTML or JavaScript.

Exploitation requires no authentication or special privileges; an attacker only needs to convince a user to visit a malicious webpage. The vulnerability is remotely exploitable over the network, as web content is processed automatically by the browser or web view. No physical access or user interaction beyond browsing is necessary.

Successful exploitation results in a denial-of-service condition through an unexpected process crash. While the impact is limited to application termination, repeated crashes could disrupt user activity. There is no indication of code execution or data exfiltration from the available information.

Apple addressed the issue in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, and visionOS 26.3, released on February 11, 2026 [1][2][3][4]. Users are advised to update their devices to the latest available versions to mitigate the risk.