CVE-2026-28847

Root

Cause

CVE-2026-28847 is an out-of-bounds read vulnerability in WebKit's memory handling. Apple's advisories state that the issue was addressed with improved bounds checking [improved bounds checking] in Safari 26.5 and across all affected operating systems [1][2][3]. The flaw resides in how the browser engine code that processes web content.

Exploitation

An attacker can exploit the vulnerability by crafting a malicious webpage or other web content. When a victim visits the page using a vulnerable browser or WebKit-based app, the out-of-bounds read occurs. No additional authentication or user interaction beyond visiting the page is required, making the attack surface broad.

Impact

Successful exploitation leads to an unexpected process crash, resulting in a denial-of-service condition. The impact is limited to application termination; Apple's advisories do not indicate that arbitrary code execution is possible [1][2][3].

Mitigation

Apple released fixes on May 11, 2026, for iOS 18.7.9/iPadOS 18.7.9, iOS 26.5/iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5 [1][2][3][4]. Users should update to the latest available versions. No workarounds are documented.