CVE-2026-28942: Apple iPadOS Use-After-Free Vulnerability

CVE-2026-28942 Overview

CVE-2026-28942 is a use-after-free memory corruption vulnerability affecting Apple's web rendering stack across multiple operating systems. Processing maliciously crafted web content can trigger an unexpected Safari crash. The flaw is classified under [CWE-416: Use After Free] and stems from improper memory management during web content processing. Apple addressed the issue with improved memory management in Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. The vulnerability requires user interaction, typically by luring a victim to a malicious web page. No public proof-of-concept exploit or in-the-wild exploitation has been reported.

Critical Impact

Remote attackers can crash Safari and impact device availability when a user visits maliciously crafted web content.

Affected Products

• Apple iOS and iPadOS prior to 26.5
• Apple macOS Tahoe prior to 26.5 and Safari prior to 26.5
• Apple tvOS, visionOS, and watchOS prior to 26.5

Discovery Timeline

• 2026-05-11 - CVE-2026-28942 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-28942

Vulnerability Analysis

The vulnerability is a use-after-free condition triggered while Safari and underlying WebKit components process attacker-controlled web content. A use-after-free occurs when a program continues to reference memory after it has been released back to the allocator. An attacker who controls the layout of the freed allocation can cause the application to read or operate on attacker-influenced data through the dangling pointer. In this case, the immediate observed impact is an unexpected Safari process crash, indicating availability impact rather than confirmed code execution. Apple resolved the issue with improved memory management, which typically involves tightening object lifetime tracking and ensuring pointers are invalidated when their referents are freed.

Root Cause

The root cause is improper memory lifecycle handling in the affected web content processing code path. An object is freed while at least one reference remains in use, producing a dangling pointer that is later dereferenced during rendering or script execution.

Attack Vector

Exploitation requires a user to load attacker-controlled web content in Safari or any application that renders pages through the affected WebKit components. The attack is remote and network-based but requires user interaction, such as clicking a link or visiting a compromised site. Attackers commonly chain such issues through drive-by downloads, malvertising, or phishing campaigns. No public exploit or proof-of-concept code is available for this issue.

For technical details on Apple's fix, see the vendor advisories: Apple Support Article #127110, Apple Support Article #127115, Apple Support Article #127118, Apple Support Article #127119, Apple Support Article #127120, and Apple Support Article #127121.

Detection Methods for CVE-2026-28942

Indicators of Compromise

• Unexpected or repeated Safari process crashes on iOS, iPadOS, macOS, tvOS, visionOS, or watchOS devices.
• Crash report entries referencing WebKit or com.apple.WebKit processes shortly after navigation events.
• Outbound network connections to recently registered domains immediately preceding browser crashes.

Detection Strategies

• Monitor endpoint telemetry for Safari and WebKit process termination events on managed Apple fleets.
• Correlate browser crash artifacts with browsing history, DNS lookups, and downloaded content to identify malicious pages.
• Inspect MDM-reported OS and Safari versions to flag devices running pre-26.5 builds that remain exposed.

Monitoring Recommendations

• Forward Apple unified logs and crash diagnostics to a centralized SIEM for retention and analysis.
• Alert on bursts of WebKit crashes across multiple users, which can indicate a malicious campaign.
• Track URL reputation telemetry from web proxies and secure web gateways to identify suspicious referrers.

How to Mitigate CVE-2026-28942

Immediate Actions Required

• Update all Apple devices to Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5.
• Enforce minimum OS versions through MDM policies and block enrollment of non-compliant devices.
• Communicate to users to avoid clicking untrusted links and to restart Safari if it crashes repeatedly.

Patch Information

Apple released fixes in Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Refer to the corresponding Apple security advisories linked in the Attack Vector section for per-platform details and download instructions.

Workarounds

• Restrict access to untrusted web content using web filtering or secure web gateway policies until devices are patched.
• Enable Safari's Lockdown Mode on high-risk user accounts to reduce the browser attack surface.
• Disable JavaScript on untrusted sites or use a hardened alternative browser where supported until updates are applied.

# Verify installed Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Check macOS version
sw_vers -productVersion

# Trigger software update check (admin)
sudo softwareupdate --list
sudo softwareupdate --install --all --restart