CVE-2026-28944: Apple iPadOS DOS Vulnerability

CVE-2026-28944 Overview

CVE-2026-28944 is a memory handling vulnerability affecting Apple's WebKit-based components across multiple operating systems. Processing maliciously crafted web content can trigger an unexpected process crash, resulting in a denial-of-service condition. Apple addressed the issue with improved memory handling in Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and visionOS 26.5. The flaw is categorized under [CWE-119], indicating improper restriction of operations within the bounds of a memory buffer. Remote attackers can exploit the vulnerability over the network without authentication or user interaction beyond loading attacker-controlled web content.

Critical Impact
Remote attackers can crash WebKit processes on unpatched Apple devices by serving malicious web content, disrupting browser availability and any application embedding web views.

Affected Products

Apple iPadOS (prior to 26.5)
Apple iOS (prior to 26.5)
Apple macOS Tahoe (prior to 26.5)
Apple visionOS (prior to 26.5)

Discovery Timeline

2026-05-11 - CVE-2026-28944 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28944

Vulnerability Analysis

The vulnerability resides in Apple's web content processing stack, which renders HTML, CSS, and JavaScript across Safari and applications embedding web views. When the engine processes specifically crafted web content, a memory handling error occurs that leads to an unexpected process termination. The flaw maps to [CWE-119], reflecting an improper restriction of operations within the bounds of a memory buffer. Apple's advisory notes the fix involved improved memory handling, indicating the original code path failed to enforce correct memory boundaries or lifecycle invariants during content parsing or rendering.

The impact is limited to availability. Successful exploitation does not disclose information or modify data, but it terminates the affected process. Applications that embed web rendering through system frameworks inherit the same exposure, broadening the attack surface beyond the Safari browser.

Root Cause

The root cause is improper memory handling within the web content rendering pipeline. According to Apple's advisory, the corrective change introduced stricter memory handling logic, suggesting the original implementation mishandled buffer boundaries, object lifetimes, or allocation state when parsing attacker-controlled content. The EPSS score is 0.058% at the 18.01 percentile.

Attack Vector

Exploitation requires the victim to load maliciously crafted web content. An attacker hosts a malicious page, embeds the payload in an advertisement, or delivers it through a link in messaging or email. No authentication or additional user interaction beyond loading the content is required. Once the content is rendered, the web process terminates unexpectedly, producing a denial-of-service condition.

No public proof-of-concept or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics are documented in Apple Support Document #127121.

Detection Methods for CVE-2026-28944

Indicators of Compromise

Repeated unexpected termination of Safari or WebKit-backed processes such as com.apple.WebKit.WebContent on macOS endpoints.
Crash reports referencing memory access faults within WebKit framework binaries.
Outbound connections to suspicious domains immediately preceding browser crashes in proxy or DNS telemetry.

Detection Strategies

Monitor endpoint crash logs and ReportCrash events for recurring WebKit process failures tied to specific URLs.
Correlate web proxy logs with crash events to identify hosts delivering payloads that consistently trigger renderer termination.
Inventory Apple devices and flag systems running Safari, iOS, iPadOS, macOS, or visionOS builds prior to the 26.5 release.

Monitoring Recommendations

Forward macOS unified logs and iOS device crash reports to a centralized analytics platform for correlation.
Alert on anomalous browser process restart frequency across managed Apple fleets.
Track URL reputation and block known malicious content delivery domains at the network egress layer.

How to Mitigate CVE-2026-28944

Immediate Actions Required

Upgrade affected devices to Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, or visionOS 26.5 without delay.
Use mobile device management (MDM) policies to enforce minimum OS versions across the Apple fleet.
Restrict browsing to trusted sites until patches are deployed on all endpoints.

Patch Information

Apple released fixes in Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and visionOS 26.5. Refer to Apple Support Document #127110, Apple Support Document #127115, Apple Support Document #127120, and Apple Support Document #127121 for release details and installation guidance.

Workarounds

Enable content blockers and disable JavaScript on untrusted sites where browser functionality permits.
Route web traffic through a secure web gateway that filters known malicious domains and scripts.
Limit use of in-app web views in custom applications until host devices are patched.

bash

# Verify macOS build version on managed endpoints
sw_vers -productVersion

# Trigger software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart