CVE-2026-28902: Apple iPadOS DoS Vulnerability

CVE-2026-28902 Overview

CVE-2026-28902 is a memory handling vulnerability affecting Apple's web content processing stack across multiple operating systems. Processing maliciously crafted web content may lead to an unexpected process crash, resulting in a denial-of-service condition. Apple addressed the issue with improved memory handling in Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. The flaw is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and requires user interaction, typically through visiting an attacker-controlled web page.

Critical Impact

Remote attackers can trigger an unexpected process crash through maliciously crafted web content, impacting application availability across Apple's product ecosystem.

Affected Products

• Apple iOS and iPadOS (prior to 26.5)
• Apple macOS Tahoe (prior to 26.5), tvOS, visionOS, and watchOS (prior to 26.5)
• Apple Safari (prior to 26.5)

Discovery Timeline

• 2026-05-11 - CVE-2026-28902 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-28902

Vulnerability Analysis

The vulnerability resides in the web content processing component shared across Apple's operating systems, most likely WebKit. When the rendering engine processes specially crafted HTML, CSS, or JavaScript content, it mishandles memory operations, causing an unexpected process termination. The affected process loses state and forces the user's browser tab or embedded web view to abort.

The attack vector is network-based and requires user interaction, such as navigating to a malicious URL or loading attacker-controlled content within an application that embeds web views. The impact is limited to availability — confidentiality and integrity are not affected based on the vendor's description.

Root Cause

Apple's advisories state the issue was addressed with improved memory handling, indicating the root cause is improper memory buffer management within the affected component. The [CWE-119] classification suggests operations on memory buffers exceeded intended boundaries, leading to memory corruption sufficient to crash the process but not documented as enabling code execution.

Attack Vector

An attacker hosts malicious web content on a website or delivers it through an application that renders web content. When a victim visits the page or loads the content, the malformed structures trigger the memory handling flaw and crash the web content process. Repeated exposure can produce a sustained denial-of-service condition against the user's browsing session or embedded web view functionality.

No public proof-of-concept or exploitation in the wild has been reported. The EPSS data indicates a low likelihood of near-term exploitation.

Detection Methods for CVE-2026-28902

Indicators of Compromise

• Repeated unexpected crashes of Safari or WebKit-based processes such as com.apple.WebKit.WebContent recorded in macOS or iOS crash logs.
• Crash reports referencing memory access violations within WebKit rendering or JavaScriptCore frames.
• Devices browsing untrusted or recently visited URLs that consistently trigger renderer termination.

Detection Strategies

• Collect and review system crash logs from macOS (~/Library/Logs/DiagnosticReports/) and iOS sysdiagnose archives for WebKit process terminations.
• Monitor mobile device management (MDM) telemetry for Apple devices reporting operating system or Safari versions below 26.5.
• Correlate web proxy logs with crash events to identify URLs that consistently coincide with renderer failures.

Monitoring Recommendations

• Track patch compliance across the Apple device fleet and alert on devices not running 26.5 or later.
• Flag anomalous spikes in Safari or WebKit process restarts on managed endpoints.
• Subscribe to Apple security advisories to receive updates on related WebKit issues.

How to Mitigate CVE-2026-28902

Immediate Actions Required

• Update all Apple devices to Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5.
• Push the update through MDM to enforce installation on managed fleets and verify compliance.
• Advise users to avoid untrusted links and web content until patches are deployed.

Patch Information

Apple released fixes in the 26.5 release train across its operating systems and Safari. Refer to the vendor advisories for full release notes: Apple Support Document #127110, Apple Support Document #127115, Apple Support Document #127118, Apple Support Document #127119, Apple Support Document #127120, and Apple Support Document #127121.

Workarounds

• Restrict web browsing to trusted sites and enforce content filtering at the network egress.
• Disable JavaScript in Safari's advanced settings for high-risk users where feasible until patching is complete.
• Use enterprise web filtering or DNS-based blocking to prevent navigation to known malicious domains.

# Verify installed macOS version meets patched release
sw_vers -productVersion

# Trigger software update check on macOS
sudo softwareupdate -l
sudo softwareupdate -i -a --restart