CVE-2026-28904 Overview
CVE-2026-28904 is a memory handling vulnerability affecting Apple's web content processing across multiple operating systems. Processing maliciously crafted web content may lead to an unexpected process crash. Apple addressed the issue with improved memory handling in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. The flaw is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and is exploitable remotely without authentication or user interaction beyond visiting attacker-controlled content.
Critical Impact
Remote attackers can trigger an unexpected process crash on Apple devices by serving maliciously crafted web content, producing a denial-of-service condition across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.
Affected Products
- Apple iOS and iPadOS prior to 18.7.9 and prior to 26.5
- Apple macOS Tahoe prior to 26.5 and Safari prior to 26.5
- Apple tvOS, visionOS, and watchOS prior to 26.5
Discovery Timeline
- 2026-05-11 - CVE-2026-28904 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-28904
Vulnerability Analysis
The vulnerability resides in the web content processing path that handles HTML, JavaScript, and related browser-rendered resources on Apple platforms. When the renderer parses maliciously crafted web content, a memory handling error causes the process to terminate unexpectedly. The flaw is reachable from any web page that the targeted device renders, including embedded WebViews used by third-party applications. Apple classifies the impact as an unexpected process crash, consistent with a high availability impact and no disclosed effect on confidentiality or integrity.
Root Cause
The underlying defect is a memory buffer handling weakness mapped to [CWE-119]. Apple's advisory states the issue was addressed with improved memory handling, indicating that bounds or lifetime constraints on a memory region were not enforced correctly during web content processing. The exact object, allocator path, and triggering content structure were not disclosed in the vendor advisory.
Attack Vector
Exploitation requires only that a target device process attacker-controlled web content. The CVSS attack vector is network-based with low complexity, no privileges, and no user interaction beyond loading the malicious content. An attacker can host the payload on a website, deliver it through an iframe embedded in a benign page, push it through advertising networks, or send it via messaging clients that preview links using the affected web engine. Successful exploitation crashes the rendering process and disrupts browsing or in-app web functionality.
No public proof-of-concept or exploit code is available. See the Apple Support advisories for vendor-specific technical details.
Detection Methods for CVE-2026-28904
Indicators of Compromise
- Repeated Safari or WebKit-based process crashes recorded in /Library/Logs/DiagnosticReports/ on macOS or in iOS crash logs synced through Xcode or MDM tooling.
- Unexpected termination of in-app browser views in applications that embed WKWebView after visiting a specific URL or domain.
- Outbound web requests from managed devices to recently registered or low-reputation domains immediately preceding renderer crashes.
Detection Strategies
- Correlate browser crash telemetry with URL access logs from web proxies or secure web gateways to identify content patterns that consistently trigger renderer termination.
- Monitor MDM-collected crash diagnostics for clusters of com.apple.WebKit.WebContent or Safari crashes across multiple devices.
- Inventory device OS and Safari versions and flag endpoints still running pre-patch builds susceptible to CVE-2026-28904.
Monitoring Recommendations
- Forward macOS unified logs and iOS diagnostic reports to a central log platform for crash trend analysis.
- Alert on spikes in WebKit process restarts on a single device or across a device cohort within short time windows.
- Track DNS and HTTP telemetry for repeated visits to URLs immediately followed by web renderer crashes.
How to Mitigate CVE-2026-28904
Immediate Actions Required
- Update affected devices to Safari 26.5, iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5.
- Enforce minimum OS versions through Mobile Device Management to block enrollment or access from unpatched endpoints.
- Prioritize patching for devices that browse untrusted content or process external links from email and messaging clients.
Patch Information
Apple released fixes across the affected platforms with improved memory handling. Refer to the official advisories: Apple Support Article #127110, #127111, #127115, #127118, #127119, #127120, and #127121.
Workarounds
- Restrict access to untrusted websites through a secure web gateway or DNS filtering service until patches are deployed.
- Configure MDM policies to limit installation and use of third-party browsers and WebView-heavy applications on unpatched devices.
- Educate users to avoid clicking unsolicited links and to report repeated Safari or in-app browser crashes to the security team.
# Verify installed iOS/iPadOS version via MDM query or on-device
# Settings > General > About > Software Version should report 18.7.9, 26.5, or later
# macOS: confirm patched build from terminal
sw_vers -productVersion
# Expected: 26.5 (macOS Tahoe) or later
# Safari version check on macOS
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString
# Expected: 26.5 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
