CVE-2026-28847 - Vulnerability Details

- webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Published: 2026-05-11

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability comes from a flaw in memory handling that can cause a process crash when maliciously crafted web content is processed. The issue is resolved by improved memory handling, with a fix in Safari 26.5, iOS 18.7.9 / 26.5, iPadOS 18.7.9 / 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. The crash produces a temporary denial of service: the affected application or operating system may become unresponsive or relaunch. There is no indication that the crash can be used for code execution or privilege escalation.

Affected Systems

Apple Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS are affected. The fix is delivered in Safari 26.5, iOS 18.7.9 and 26.5, iPadOS 18.7.9 and 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity impact. The EPSS score of less than 1 % and the absence from CISA’s KEV catalog suggest that no publicly confirmed exploits exist as of the latest data. The likely attack vector is the delivery of malicious web content, which is inferred from the description but not explicitly detailed; the precise method of delivery (browser, embedded web view, or other renderer) is not specified. Provided that the bug does not grant code execution, the risk remains limited to denial of service until an exploit that converts the crash into a more severe attack emerges.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

Safari

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.9
`0`	affected	< 26.5

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor Product Confidence Versions

Apple

Ios And Ipados

100%

Version	Status	Scheme	Platform
`[0,18.7.9)`	affected	semver	—
`[0,26.5)`	affected	generic	—

Apple

Macos

100%

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Tvos

100%

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Visionos

100%

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Watchos

100%

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest OS updates that include the memory‑handling fix (iOS 18.7.9/26.5, iPadOS 18.7.9/26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5).
Limit or disable loading of untrusted web content where possible, such as by adjusting secure browsing settings or tightening app sandbox policies.
Keep all browsers and any components that render web content updated to ensure the memory‑handling improvements are in place.

Generated by OpenCVE AI on June 3, 2026 at 04:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00044.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-28847
https://support.apple.com/en-us/127110
https://support.apple.com/en-us/127111
https://support.apple.com/en-us/127115
https://support.apple.com/en-us/127118
https://support.apple.com/en-us/127119
https://support.apple.com/en-us/127120
https://support.apple.com/en-us/127121
https://webkitgtk.org/security/WSA-2026-0003.html
https://www.cve.org/CVERecord?id=CVE-2026-28847
https://www.zerodayinitiative.com/advisories/ZDI-26-313/

History

Wed, 03 Jun 2026 02:30:00 +0000

Type	Values Removed	Values Added
Title	Process Crash via Malicious Web Content in Apple Browsers and Operating Systems	webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
Weaknesses		CWE-120
References		https://nvd.nist.gov/vuln/detail/CVE-2026-28847 https://webkitgtk.org/security/WSA-2026-0003.html https://www.cve.org/CVERecord?id=CVE-2026-28847
Metrics	threat_severity `None`	threat_severity `Important`

Fri, 22 May 2026 16:00:00 +0000

Type	Values Removed	Values Added
Title		Process Crash via Malicious Web Content in Apple Browsers and Operating Systems

Fri, 22 May 2026 13:30:00 +0000

Type	Values Removed	Values Added
References		https://www.zerodayinitiative.com/advisories/ZDI-26-313/
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 14 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple ipados Apple iphone Os

Wed, 13 May 2026 23:15:00 +0000

Type	Values Removed	Values Added
Title	Memory Handling Crash via Malicious Web Content Leading to Denial of Service

Wed, 13 May 2026 21:00:00 +0000

Type	Values Removed	Values Added
Title		Memory Handling Crash via Malicious Web Content Leading to Denial of Service

Wed, 13 May 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.	The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
References		https://support.apple.com/en-us/127121

Wed, 13 May 2026 19:15:00 +0000

Type	Values Removed	Values Added
Title	Memory Handling Bug Causing Process Crashes from Malicious Web Content
Weaknesses	CWE-665

Wed, 13 May 2026 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 11 May 2026 22:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple tvos Apple visionos Apple watchos
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple tvos Apple visionos Apple watchos

Mon, 11 May 2026 22:00:00 +0000

Type	Values Removed	Values Added
Title		Memory Handling Bug Causing Process Crashes from Malicious Web Content
Weaknesses		CWE-119 CWE-665

Mon, 11 May 2026 20:45:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
References		https://support.apple.com/en-us/127110 https://support.apple.com/en-us/127111 https://support.apple.com/en-us/127115 https://support.apple.com/en-us/127118 https://support.apple.com/en-us/127119 https://support.apple.com/en-us/127120

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Tvos Visionos Watchos

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-05-11T20:07:35.962Z

Updated: 2026-05-22T12:57:49.600Z

Reserved: 2026-03-03T16:36:03.970Z

Link: CVE-2026-28847

Vulnrichment

Updated: 2026-05-13T13:14:16.381Z

NVD

Status : Modified

Published: 2026-05-11T21:18:51.507

Modified: 2026-05-22T14:16:24.917

Link: CVE-2026-28847

Redhat

Severity : Important

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-28847 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-03T04:15:24Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object