Description
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.
Published: 2026-03-25
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A memory handling flaw in WebKitGTK causes processes to crash when a web page contains maliciously crafted content. The bug can trigger buffer overflows, underflows, use‑after‑free, or out‑of‑bounds writes, resulting in unauthorized disruption of the affected web rendering process. The primary impact is loss of availability, as end users experience application crashes without data loss or exposure of sensitive information.

Affected Systems

Apple products running Safari, iOS, iPadOS, macOS, and visionOS are vulnerable. Tested versions below Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4 are affected. The issue is fixed in the 26.4 release series for all listed operating systems and browsers.

Risk and Exploitability

The CVSS base score is 6.5, indicating medium severity. The EPSS score is less than 1 %, implying a low probability of exploitation in the wild. The vulnerability is not cataloged in CISA’s KEV list. Based on the description, it is inferred that the attack vector is remote, requiring delivery of malicious content via a web page or application that renders with WebKitGTK.

Generated by OpenCVE AI on March 31, 2026 at 05:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Safari to version 26.4 or later
  • Update iOS to version 26.4 or later
  • Update iPadOS to version 26.4 or later
  • Update macOS to version 26.4 or later
  • Update visionOS to version 26.4 or later
  • Verify that all affected devices run the patched version to eliminate the crash risk

Generated by OpenCVE AI on March 31, 2026 at 05:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 31 Mar 2026 03:00:00 +0000

Type Values Removed Values Added
Title Memory Handling Crash Vulnerability in Apple Safari and OS Platforms webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash
Weaknesses CWE-120
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 27 Mar 2026 09:30:00 +0000

Type Values Removed Values Added
Title Memory Handling Crash Vulnerability in Apple Safari and OS Platforms

Thu, 26 Mar 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Thu, 26 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CWE-416
CWE-787
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 12:30:00 +0000

Type Values Removed Values Added
Title Safari and Apple OS Crash from Malicious Web Content
Weaknesses CWE-787

Wed, 25 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Title Safari and Apple OS Crash from Malicious Web Content
Weaknesses CWE-787

Wed, 25 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos

Wed, 25 Mar 2026 01:00:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari Visionos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:12:45.416Z

Reserved: 2026-03-03T16:36:03.972Z

Link: CVE-2026-28857

cve-icon Vulnrichment

Updated: 2026-03-26T14:34:07.646Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-25T01:17:09.817

Modified: 2026-03-26T18:25:21.360

Link: CVE-2026-28857

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-28T20:00:00Z

Links: CVE-2026-28857 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-03-31T20:09:17Z

Weaknesses