CVE-2026-28905 Overview
CVE-2026-28905 is a memory handling vulnerability affecting multiple Apple operating systems, including Safari, iOS, iPadOS, macOS, tvOS, and visionOS. Apple addressed the issue with improved memory handling in Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, and visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash. The flaw is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and is exploitable over the network without authentication or user interaction.
Critical Impact
A remote attacker can trigger an unexpected process crash by serving maliciously crafted web content, resulting in denial of service for the browser process.
Affected Products
- Apple iOS and iPadOS prior to 26.5
- Apple macOS Tahoe prior to 26.5 and Safari prior to 26.5
- Apple tvOS prior to 26.5 and visionOS prior to 26.5
Discovery Timeline
- 2026-05-11 - CVE-2026-28905 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-28905
Vulnerability Analysis
The vulnerability resides in Apple's web content processing stack, used by Safari and any application embedding WebKit on iOS, iPadOS, macOS, tvOS, and visionOS. According to Apple's advisory, the issue was addressed with improved memory handling, indicating that prior versions performed insufficient bounds or lifetime checks on memory operations when parsing or rendering hostile web content.
Exploitation requires only that a victim load attacker-controlled web content. No credentials or user interaction beyond browsing are required. The observed impact is an unexpected process crash, affecting the availability of the rendering process. Apple has not indicated that arbitrary code execution is achievable through this specific issue, and there are no public reports of in-the-wild exploitation or active inclusion in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is improper restriction of operations within the bounds of a memory buffer [CWE-119] in WebKit's processing of crafted web content. Memory handling logic failed to consistently enforce safe access patterns, allowing malformed input to corrupt or read invalid memory regions and terminate the process.
Attack Vector
The attack vector is network-based. An attacker hosts a malicious page or embeds malicious markup, script, or media inside content delivered through advertising, iframes, email previews, or any embedded WebKit view. When the target system parses the content, the memory handling defect triggers and crashes the WebKit process. Repeated crashes can be used to interrupt browsing sessions or disrupt applications that rely on web rendering.
No verified public proof-of-concept code is available. Refer to the Apple security advisory for vendor technical details.
Detection Methods for CVE-2026-28905
Indicators of Compromise
- Unexpected and repeated crashes of Safari, WebKit, or com.apple.WebKit.WebContent processes recorded in system crash logs.
- Crash reports referencing memory access faults (EXC_BAD_ACCESS, SIGSEGV) generated while rendering specific URLs.
- Outbound connections from browser sessions to newly observed or low-reputation domains immediately preceding the crash event.
Detection Strategies
- Monitor macOS DiagnosticReports and iOS device crash telemetry for clusters of WebKit content process terminations correlated with specific URLs.
- Inspect endpoint and network logs for users visiting the same domain prior to repeated browser crashes across multiple devices.
- Validate installed OS and Safari build versions across the fleet to identify systems still below the 26.5 baseline.
Monitoring Recommendations
- Centralize browser and WebKit crash reports for correlation with URL access logs and DNS queries.
- Track Apple OS patch compliance for all managed iPhones, iPads, Macs, Apple TVs, and Vision Pro devices through MDM reporting.
- Alert on anomalous spikes in WebKit content process terminations across endpoints in a short time window.
How to Mitigate CVE-2026-28905
Immediate Actions Required
- Update affected devices to Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, or visionOS 26.5.
- Prioritize patching for devices used to access untrusted web content or external email.
- Verify MDM compliance policies enforce the minimum patched OS version before granting access to corporate resources.
Patch Information
Apple released fixes in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, and visionOS 26.5. See the vendor advisories: Apple Support Document #127110, Apple Support Document #127115, Apple Support Document #127118, Apple Support Document #127120, and Apple Support Document #127121.
Workarounds
- Restrict browsing to trusted sites until patches are applied, and block known malicious domains at the network egress.
- Disable JavaScript in Safari Advanced settings on high-risk devices that cannot be updated immediately.
- Apply enterprise content filtering and DNS-based reputation controls to reduce exposure to attacker-controlled pages.
# Verify installed macOS and Safari versions
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
