CVE-2026-28984 - Vulnerability Details

- webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Published: 2026-08-17

Score: 4.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability stems from unsafe memory handling within Safari, where maliciously crafted web content can trigger a crash. The crash causes Safari to terminate unexpectedly, resulting in a local denial-of-service condition for the device. There is no evidence that the flaw permits code execution or remote compromise.

Affected Systems

Apple’s Safari on macOS, iOS, iPadOS, tvOS, visionOS, and watchOS is affected. Devices running versions prior to Safari 26.5, iOS 18.7.10, iPadOS 18.7.10, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5 are vulnerable. The issue is resolved in the releases mentioned above.

Risk and Exploitability

The exploit is likely local, requiring a user to view or interact with harmful web content. The EPSS score is less than 1%, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is 4.3, indicating a moderate risk for affected users.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

Safari

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.10
`0`	affected	< 26.5

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.5

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::

No data.

Vendor Product Confidence Versions

Apple

Ios And Ipados

100%

Version	Status	Scheme	Platform
`[0,18.7.10)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the official Apple security update that includes Safari 26.5, iOS 18.7.10, iPadOS 18.7.10, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.
If a device is not yet eligible for the latest OS version, apply any interim Apple update that incorporates the memory handling improvement, as detailed in the provided support articles.
Until the patch is applied, mitigate exposure by enabling safe browsing or content restrictions on Safari and other web browsers to reduce the likelihood of encountering malicious content that could trigger a crash.

Generated by OpenCVE AI on August 26, 2026 at 04:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8703-1	WebKitGTK vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00224.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-28984
https://support.apple.com/en-us/127110
https://support.apple.com/en-us/127115
https://support.apple.com/en-us/127118
https://support.apple.com/en-us/127119
https://support.apple.com/en-us/127120
https://support.apple.com/en-us/127121
https://support.apple.com/en-us/148287
https://webkitgtk.org/security/WSA-2026-0005.html
https://www.cve.org/CVERecord?id=CVE-2026-28984

History

Tue, 25 Aug 2026 19:45:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. Processing maliciously crafted web content may lead to an unexpected Safari crash.	The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References		https://support.apple.com/en-us/127110 https://support.apple.com/en-us/127115 https://support.apple.com/en-us/127118 https://support.apple.com/en-us/127119 https://support.apple.com/en-us/127120 https://support.apple.com/en-us/127121

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Title		webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
Weaknesses		CWE-120
References		https://nvd.nist.gov/vuln/detail/CVE-2026-28984 https://webkitgtk.org/security/WSA-2026-0005.html https://www.cve.org/CVERecord?id=CVE-2026-28984
Metrics	threat_severity `None`	threat_severity `Important`

Wed, 19 Aug 2026 02:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 18 Aug 2026 20:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os::::::::
Vendors & Products		Apple ipados Apple iphone Os

Tue, 18 Aug 2026 16:15:00 +0000

Type	Values Removed	Values Added
Title	Safari Crash via Malicious Web Content Leading to Denial of Service

Tue, 18 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}`

Mon, 17 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Title		Safari Crash via Malicious Web Content Leading to Denial of Service
First Time appeared		Apple Apple ios And Ipados
Weaknesses		CWE-416
Vendors & Products		Apple Apple ios And Ipados

Mon, 17 Aug 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. Processing maliciously crafted web content may lead to an unexpected Safari crash.
References		https://support.apple.com/en-us/148287

Subscriptions

Apple Ios And Ipados Ipados Iphone Os

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-08-17T21:30:37.215Z

Updated: 2026-08-25T19:24:54.642Z

Reserved: 2026-03-03T16:36:03.993Z

Link: CVE-2026-28984

Vulnrichment

Updated: 2026-08-18T13:32:10.043Z

NVD

Status : Modified

Published: 2026-08-17T22:17:04.010

Modified: 2026-08-25T20:16:54.227

Link: CVE-2026-28984

Redhat

Severity : Important

Publid Date: 2026-08-20T00:00:00Z

Links: CVE-2026-28984 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-26T05:00:12Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object