CVE-2026-28955

Description

CVE-2026-28955 is a vulnerability in Apple's WebKit engine that allows remote attackers to cause an unexpected process crash by processing maliciously crafted web content. The root cause is an out-of-bounds read, which was addressed with improved bounds checking in the affected software versions [1][2][3].

Attack

Vector

Exploitation requires no user interaction beyond visiting a malicious website. The attacker does not need any special privileges or network position; the vulnerability is triggered automatically when the web content is processed by Safari or any other application using WebKit on affected Apple platforms.

Impact

Successful exploitation results in a denial-of-service (DoS) condition as the application crashes unexpectedly. The crash may cause the browser to terminate or the entire device to become temporarily unresponsive. There is no indication of code execution or data exfiltration based on the available information.

Mitigation

Apple has released patches in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Users are advised to update to the latest versions to mitigate the vulnerability [1][2][3][4].