CVE-2026-28979: Apple Safari DOS Vulnerability

CVE-2026-28979 Overview

CVE-2026-28979 is an out-of-bounds access vulnerability affecting Apple Safari, iOS, iPadOS, and macOS Tahoe. The flaw resides in Apple's web content processing components and is triggered when a user visits a maliciously crafted web page. Successful exploitation causes an unexpected process crash, resulting in denial of service on affected clients. Apple addressed the issue through improved bounds checking in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. The vulnerability is classified under [CWE-125] (Out-of-Bounds Read) and requires user interaction to exploit.

Critical Impact
Processing malicious web content can trigger an unexpected process crash across Safari and Apple operating systems, disrupting browser and application availability.

Affected Products

Apple Safari (prior to 26.5.2)
Apple iOS and iPadOS (prior to 26.5.2)
Apple macOS Tahoe (prior to 26.5.2)

Discovery Timeline

2026-06-29 - CVE-2026-28979 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-28979

Vulnerability Analysis

CVE-2026-28979 stems from an out-of-bounds access condition in Apple's web content handling stack, which underpins Safari and the WebKit-based rendering used by iOS, iPadOS, and macOS. When the affected component parses maliciously crafted web content, it reads memory beyond the bounds of an allocated buffer. This out-of-bounds read corrupts execution state and triggers an unexpected process crash. Apple's advisories confirm the fix was implemented through improved bounds checking on the affected code path.

The issue is remotely reachable over the network and requires user interaction, typically visiting an attacker-controlled page or opening embedded content in an application that uses WebKit. Confidentiality and integrity are not directly impacted, but availability is degraded because the rendering process terminates. Repeated exploitation could be chained with other browser flaws to weaken exploit mitigations, though no public exploit or in-the-wild activity has been reported.

Root Cause

The root cause is missing or insufficient bounds checking when the web content parser accesses memory during processing of specific structures in attacker-supplied content. Because the affected path did not validate offsets against buffer size, malformed inputs induced reads outside the intended allocation and crashed the process.

Attack Vector

An attacker hosts a malicious web page or embeds crafted content in an application that renders web content through WebKit. When a user visits the page or opens the content, the parsing logic performs an out-of-bounds access and the process crashes. No authentication is required, and the attack complexity is low, though user interaction is mandatory.

The vulnerability manifests during web content parsing. Refer to Apple's advisories (HT127594, HT127595, HT127685) for vendor guidance.

Detection Methods for CVE-2026-28979

Indicators of Compromise

Repeated unexpected crashes of Safari or WebKit-hosted processes such as com.apple.WebKit.WebContent on macOS and iOS devices.
Presence of Apple ips crash reports referencing SIGSEGV or EXC_BAD_ACCESS within WebKit modules following user navigation to unfamiliar domains.
Endpoint telemetry showing browser navigation to newly registered or low-reputation domains immediately before renderer crashes.

Detection Strategies

Monitor endpoint logs for elevated crash rates in Safari and other WebKit-backed applications correlated with specific URLs.
Inspect proxy and DNS logs for user visits to domains hosting malformed HTML, SVG, or JavaScript content preceding client instability.
Correlate browser process termination events with parent user sessions to identify targeted user interaction patterns.

Monitoring Recommendations

Track installed Safari, iOS, iPadOS, and macOS versions across managed fleets and flag devices running builds earlier than 26.5.2.
Alert on abnormal spikes in WebKit renderer restarts within short time windows on individual endpoints.
Ingest Apple crash telemetry into a central log platform for retrospective hunting once new indicators surface.

How to Mitigate CVE-2026-28979

Immediate Actions Required

Update Safari to version 26.5.2 on macOS systems where the browser is installed independently of the OS.
Upgrade iOS and iPadOS devices to 26.5.2 through Software Update or mobile device management (MDM) policies.
Upgrade macOS Tahoe systems to 26.5.2 to receive the bundled WebKit fix.
Prioritize patching for users who routinely access external or untrusted web content.

Patch Information

Apple has released fixes in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Details are published in Apple Support Article 127594, Apple Support Article 127595, and Apple Support Article 127685. Administrators should validate patch deployment through inventory tools and enforce compliance via MDM.

Workarounds

Restrict browsing to trusted sites and enable content filtering at the network perimeter until patches are applied.
Use enterprise policy to disable preview of untrusted web content in applications that embed WebKit where feasible.
Educate users to avoid clicking unsolicited links and to report unexpected Safari crashes to security operations.

bash

# Verify Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Check macOS build
sw_vers

# Trigger software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart