CVE-2026-28857: Apple Safari DOS Vulnerability

CVE-2026-28857 Overview

CVE-2026-28857 is an Out-of-Bounds Read vulnerability affecting multiple Apple products including Safari, iOS, iPadOS, macOS Tahoe, and visionOS. The vulnerability exists due to improper memory handling when processing web content. When a user visits a maliciously crafted webpage, the vulnerable component fails to properly validate memory boundaries, potentially leading to an unexpected process crash.

This vulnerability can be exploited remotely over a network connection, requiring user interaction (visiting a malicious website). Successfully exploiting this vulnerability allows an attacker to cause a denial-of-service condition by crashing the affected browser or application process.

Critical Impact

Processing maliciously crafted web content may lead to an unexpected process crash, causing denial-of-service conditions across Safari browser and WebKit-based applications on Apple devices.

Affected Products

• Apple Safari (versions prior to 26.4)
• Apple iOS and iPadOS (versions prior to 26.4)
• Apple macOS Tahoe (versions prior to 26.4)
• Apple visionOS (versions prior to 26.4)

Discovery Timeline

• 2026-03-25 - CVE-2026-28857 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-28857

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory corruption issue that occurs when a program reads data from a memory location outside the bounds of the intended buffer. In the context of Apple's WebKit rendering engine, this flaw manifests during the processing of specially crafted web content.

The vulnerability requires network access and user interaction to exploit. An attacker must craft malicious web content and entice a victim to load it in Safari or any WebKit-based application. When the vulnerable code path is triggered, the out-of-bounds read causes the application to access memory it should not, resulting in a process crash.

While the immediate impact is limited to availability (denial of service via process crash), out-of-bounds read vulnerabilities can sometimes be chained with other weaknesses to leak sensitive memory contents or be used as primitives in more sophisticated exploit chains.

Root Cause

The root cause of CVE-2026-28857 lies in insufficient bounds checking within Apple's memory handling routines when processing web content. The WebKit engine failed to properly validate buffer boundaries during certain operations, allowing read access to memory locations outside the allocated buffer space.

Apple addressed this issue with improved memory handling, implementing proper boundary validation to ensure memory read operations stay within expected buffer limits.

Attack Vector

The attack vector for this vulnerability is network-based, requiring user interaction:

1. An attacker crafts malicious web content designed to trigger the out-of-bounds read condition
2. The victim visits the attacker-controlled webpage or is redirected to it through various means (phishing, malvertising, compromised websites)
3. The WebKit rendering engine processes the malicious content
4. The improper memory handling triggers an out-of-bounds read
5. The affected process (Safari, or any WebKit-based app) crashes unexpectedly

The vulnerability does not require authentication or elevated privileges, making it accessible to any attacker capable of hosting or injecting malicious web content.

Detection Methods for CVE-2026-28857

Indicators of Compromise

• Unexpected Safari or WebKit-based application crashes occurring repeatedly
• Crash reports showing memory access violations in WebKit components
• Users reporting browser crashes after visiting specific websites
• Unusual patterns of browser process terminations in system logs

Detection Strategies

• Monitor for abnormal process termination events in Safari and WebKit-related processes
• Implement web filtering to block known malicious domains serving exploit content
• Deploy endpoint detection solutions capable of identifying anomalous browser behavior
• Review system crash logs (/Library/Logs/DiagnosticReports/) for WebKit-related crash signatures

Monitoring Recommendations

• Enable crash reporting and aggregate crash data across managed devices to identify patterns
• Monitor for indicators of targeted attacks through correlation of browser crashes with network activity
• Implement SentinelOne endpoint protection to detect and respond to exploitation attempts in real-time
• Establish baseline browser behavior metrics to identify deviations indicative of exploitation

How to Mitigate CVE-2026-28857

Immediate Actions Required

• Update Safari to version 26.4 or later immediately
• Update iOS and iPadOS devices to version 26.4 or later
• Update macOS Tahoe to version 26.4 or later
• Update visionOS devices to version 26.4 or later
• Enable automatic updates on all Apple devices to ensure timely security patches

Patch Information

Apple has released security updates addressing this vulnerability across all affected platforms. The following resources contain detailed patch information:

• Apple Support Advisory #126792
• Apple Support Advisory #126794
• Apple Support Advisory #126799
• Apple Support Advisory #126800

Organizations should prioritize deployment of these updates, particularly for devices that regularly browse untrusted web content.

Workarounds

• Use content blockers to restrict JavaScript and complex web content from untrusted sources
• Implement network-level web filtering to block access to known malicious domains
• Consider using alternative browsers temporarily while patches are being deployed (though note WebKit is shared across many iOS apps)
• Restrict browsing to trusted sites until updates can be applied
• Enable Safari's "Fraudulent Website Warning" feature for additional protection

# Check current Safari version on macOS
/Applications/Safari.app/Contents/MacOS/Safari --version

# Verify macOS version includes security fix
sw_vers -productVersion

# Enable automatic updates via command line (macOS)
sudo softwareupdate --schedule on

# Check for available updates
softwareupdate --list