CVE-2026-28903: Apple iPadOS DoS Vulnerability

CVE-2026-28903 Overview

CVE-2026-28903 is a memory handling vulnerability affecting Apple's WebKit-based web content processing across multiple operating systems. Processing maliciously crafted web content may lead to an unexpected process crash, resulting in a denial-of-service condition. Apple addressed the issue with improved memory handling in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. The flaw is categorized under [CWE-119] (improper restriction of operations within the bounds of a memory buffer).

Critical Impact

A network-based attacker can trigger an unexpected process crash by enticing a user to visit a malicious web page, disrupting browser availability across Apple devices.

Affected Products

• Apple iOS and iPadOS (versions prior to 18.7.9 and 26.5)
• Apple macOS Tahoe (prior to 26.5) and Safari (prior to 26.5)
• Apple tvOS, visionOS, and watchOS (prior to 26.5)

Discovery Timeline

• 2026-05-11 - CVE-2026-28903 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-28903

Vulnerability Analysis

The vulnerability resides in the web content processing component used by Safari and other WebKit-dependent applications on Apple platforms. When the browser engine parses specially crafted HTML, CSS, or JavaScript content, it performs memory operations outside the intended buffer bounds. This triggers an unexpected termination of the rendering process. The flaw maps to [CWE-119], a class of memory safety errors affecting confidentiality, integrity, or availability depending on the exploit primitive achieved.

In this case, the documented impact is limited to process crash, indicating an availability-only outcome rather than arbitrary code execution. Exploitation requires user interaction, typically the act of loading attacker-controlled content in a vulnerable browser session.

Root Cause

Apple's advisory states the issue was addressed with improved memory handling. Improper validation during the parsing or rendering of untrusted web content allows out-of-bounds memory access. The condition is reachable through standard web navigation, meaning any embedded iframe, ad network, or malicious link can deliver the trigger payload.

Attack Vector

An attacker hosts crafted web content on a controlled domain or injects it into a compromised site. When a user opens the page in Safari or any application embedding WebKit, the renderer executes the malformed structure and crashes. The attack does not require authentication and operates over the network, but a user must actively load the content. See the Apple Security Update Advisory for full vendor details.

No exploitation in the wild has been reported, and no public proof-of-concept is available at the time of publication.

Detection Methods for CVE-2026-28903

Indicators of Compromise

• Repeated unexpected crashes of Safari or WebKit-based applications correlated with visits to untrusted domains.
• Crash reports referencing WebKit rendering processes or memory faults in com.apple.WebKit.WebContent.
• Web traffic to newly registered or low-reputation domains immediately preceding browser process termination.

Detection Strategies

• Monitor endpoint telemetry for abnormal termination of WebKit content processes on macOS and iOS managed devices.
• Correlate browser crash events with proxy or DNS logs to identify URLs that triggered the failure.
• Inspect crash logs under ~/Library/Logs/DiagnosticReports/ for recurring signatures tied to web content rendering.

Monitoring Recommendations

• Aggregate macOS unified logging and crash reports in a centralized analytics platform for trend analysis.
• Track Safari and WebKit version inventory across managed Apple devices to confirm patch coverage.
• Alert on clusters of crash events affecting multiple users browsing the same external domain.

How to Mitigate CVE-2026-28903

Immediate Actions Required

• Update affected devices to Safari 26.5, iOS 18.7.9 or 26.5, iPadOS 18.7.9 or 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.
• Enforce automatic OS update policies through Mobile Device Management (MDM) for organization-managed Apple endpoints.
• Communicate the advisory to users and prioritize patching for high-risk roles that handle untrusted web content.

Patch Information

Apple released fixed versions on the platforms listed in advisories 127110, 127111, 127115, 127118, 127119, 127120, and 127121. Apply the corresponding update for each operating system to remediate the memory handling defect.

Workarounds

• Restrict browsing to trusted domains using web filtering or DNS security controls until patches are deployed.
• Disable JavaScript for untrusted sites within Safari preferences to reduce the attack surface in WebKit rendering.
• Use enterprise content filtering proxies to block known malicious URLs delivering crafted web payloads.

# Verify installed macOS and Safari versions on managed endpoints
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString