CVE-2026-28947

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

Published May 11, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Analysis

Technical impact

A use‑after‑free bug in Safari’s memory handling can be triggered by maliciously crafted web content, causing the browser to crash unexpectedly and denying service. This flaw is a classic use‑after‑free vulnerability (CWE‑416) and has been corrected in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

Affected Systems

Apple’s Safari on all major platforms – iOS, iPadOS, macOS, tvOS, visionOS, and watchOS – is vulnerable. Devices running any version before 26.5 or before the 18.7.10 update for iOS and iPadOS are affected; the 26.5 releases contain the required memory‑management fix.

Risk and Exploitability

The primary risk is a denial‑of‑service that crashes Safari when a user views carefully crafted content. The CVSS score of 8.8 indicates high severity, while the EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Because Safari is the default browser on every Apple device, widespread crashes can disrupt many users, though the CVE does not explicitly mention remote code execution. The likely attack vector is through accessing malicious web pages or embedded web views.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

Safari

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.10
`0`	affected	< 26.5

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor Product Versions

Apple

Ios And Ipados

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Macos

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Tvos

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Visionos

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Apple

Watchos

Version	Status	Scheme	Platform
`[0,26.5)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest operating‑system updates that include Safari 26.5 to all affected devices.
If a device must remain on an older OS, restrict or block the execution of untrusted web content in Safari or disable automatic opening of external URLs until the update is applied.
After updating, monitor for rapid increases in Safari crash reports and investigate any patterns that may indicate targeted exploitation.

Generated by OpenCVE AI on August 17, 2026 at 22:25 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6398-1	webkit2gtk security update
Ubuntu USN	USN-8703-1	WebKitGTK vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.378% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://access.redhat.com/errata/RHSA-2026:25918
https://access.redhat.com/errata/RHSA-2026:25927
https://access.redhat.com/errata/RHSA-2026:27728
https://access.redhat.com/errata/RHSA-2026:27785
https://access.redhat.com/errata/RHSA-2026:27804
https://access.redhat.com/errata/RHSA-2026:28114
https://access.redhat.com/errata/RHSA-2026:28146
https://access.redhat.com/errata/RHSA-2026:28147
https://access.redhat.com/errata/RHSA-2026:28148
https://access.redhat.com/security/cve/CVE-2026-28947
https://bugzilla.redhat.com/show_bug.cgi?id=2483964
https://nvd.nist.gov/vuln/detail/CVE-2026-28947
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28947.json
https://support.apple.com/en-us/127110
https://support.apple.com/en-us/127115
https://support.apple.com/en-us/127118
https://support.apple.com/en-us/127119
https://support.apple.com/en-us/127120
https://support.apple.com/en-us/127121
https://support.apple.com/en-us/148287
https://webkitgtk.org/security/WSA-2026-0003.html
https://www.cve.org/CVERecord?id=CVE-2026-28947

History

Aug 17, 2026 9:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.	A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References		https://support.apple.com/en-us/148287

Jun 3, 2026 2:30 AM Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
References		https://nvd.nist.gov/vuln/detail/CVE-2026-28947 https://webkitgtk.org/security/WSA-2026-0003.html https://www.cve.org/CVERecord?id=CVE-2026-28947
Metrics	threat_severity `None`	threat_severity `Important`

May 13, 2026 8:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.	A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References		https://support.apple.com/en-us/127121

May 13, 2026 3:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple ipados Apple iphone Os

May 12, 2026 10:45 PM Title updated View changes

Type	Values Removed	Values Added
Title	Use‑After‑Free in Safari Causing Unexpected Crash via Malicious Web Content

May 12, 2026 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

May 11, 2026 10:15 PM Title updated. First appearance in the feed. Weaknesses updated. Affected vendors updated View changes

Type	Values Removed	Values Added
Title		Use‑After‑Free in Safari Causing Unexpected Crash via Malicious Web Content
First Time appeared		Apple Apple ios And Ipados Apple macos Apple tvos Apple visionos Apple watchos
Weaknesses		CWE-416
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple tvos Apple visionos Apple watchos

May 11, 2026 8:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References		https://support.apple.com/en-us/127110 https://support.apple.com/en-us/127115 https://support.apple.com/en-us/127118 https://support.apple.com/en-us/127119 https://support.apple.com/en-us/127120