CVE-2026-28913: Apple iPadOS DOS Vulnerability

CVE-2026-28913 Overview

CVE-2026-28913 is a memory handling vulnerability affecting Apple's WebKit browser engine across multiple operating systems. Processing maliciously crafted web content can lead to an unexpected process crash, resulting in a denial-of-service condition. Apple addressed the issue through improved memory handling in Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, and watchOS 26.5. The vulnerability is classified under [CWE-119] for improper restriction of operations within the bounds of a memory buffer. An attacker can trigger the condition remotely without authentication or user interaction by serving crafted web content to a vulnerable client.

Critical Impact
Remote attackers can crash WebKit processes on unpatched Apple devices by delivering malicious web content, disrupting browser availability across iOS, iPadOS, macOS, tvOS, and watchOS.

Affected Products

Apple iOS and iPadOS prior to 26.5
Apple macOS Tahoe prior to 26.5 and Safari prior to 26.5
Apple tvOS prior to 26.5 and watchOS prior to 26.5

Discovery Timeline

2026-05-11 - CVE-2026-28913 published to the National Vulnerability Database
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28913

Vulnerability Analysis

The vulnerability resides in WebKit, the browser engine that powers Safari and any application rendering web content on Apple platforms. Apple's advisory states that processing maliciously crafted web content may lead to an unexpected process crash. The condition maps to [CWE-119], indicating improper restriction of operations within a memory buffer's bounds. The remediation note from Apple specifically references improved memory handling, narrowing the root cause to a memory safety defect rather than a logic flaw. Successful triggering forces the WebContent process to terminate, breaking the browsing session and any embedded WebKit views in third-party apps.

Root Cause

The defect originates in WebKit's handling of attacker-controlled web content during parsing or rendering. Insufficient validation of buffer boundaries allowed crafted input to drive the engine into an invalid memory state. Apple's fix introduces stricter memory handling to prevent the unsafe access pattern.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction beyond visiting a page. An attacker hosts crafted HTML, JavaScript, or related web content and lures the victim's browser or WebKit-based app to load it. Malvertising, compromised sites, and iframe injections are practical delivery channels. Impact is limited to availability — the advisory notes only a process crash, with no indication of code execution or data disclosure.

No verified public proof-of-concept code is available for this vulnerability. Apple's security advisories at Apple Security Advisory 127110, Apple Security Advisory 127115, Apple Security Advisory 127118, Apple Security Advisory 127119, and Apple Security Advisory 127121 provide vendor-confirmed technical context.

Detection Methods for CVE-2026-28913

Indicators of Compromise

Repeated unexpected terminations of the com.apple.WebKit.WebContent process or Safari renderer tabs on a given device
Crash reports referencing WebKit frames such as WebCore or JavaScriptCore shortly after navigating to untrusted URLs
Outbound connections from browsers to recently registered or low-reputation domains preceding renderer crashes

Detection Strategies

Inventory endpoints and mobile devices to identify systems running Safari, iOS, iPadOS, macOS, tvOS, or watchOS versions below 26.5
Correlate browser crash telemetry with web proxy logs to surface clusters of WebKit terminations tied to specific URLs or domains
Monitor MDM compliance reports for devices that have not received the 26.5 update train

Monitoring Recommendations

Forward macOS unified logs and iOS crash diagnostics to a central log platform and alert on recurring WebKit process exits
Track web gateway telemetry for users repeatedly hitting URLs that precede renderer instability
Review Safari and WebKit-based app version data from endpoint inventory tools on a recurring cadence

How to Mitigate CVE-2026-28913

Immediate Actions Required

Update all Apple endpoints to Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, and watchOS 26.5
Push the update through MDM with enforcement deadlines for managed iPhones, iPads, and Macs
Prioritize remediation for users handling sensitive data or browsing untrusted external content

Patch Information

Apple released the fix in Safari 26.5 and the 26.5 OS train. Patch details are documented in Apple Security Advisory 127110, Apple Security Advisory 127115, Apple Security Advisory 127118, Apple Security Advisory 127119, and Apple Security Advisory 127121.

Workarounds

Restrict browsing to trusted sites until patches are deployed, using web filtering at the network gateway
Disable JavaScript in Safari for high-risk users via configuration profile until the update is applied
Block known malicious or untrusted domains at the DNS layer to reduce exposure to crafted web content

bash

# Verify Safari and macOS versions on a managed Mac
sw_vers -productVersion
/usr/bin/defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Trigger software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart