CVE-2026-28984: Apple iPadOS Safari DOS Vulnerability

CVE-2026-28984 Overview

CVE-2026-28984 is a memory handling vulnerability in Apple iOS and iPadOS that affects Safari web content processing. Processing maliciously crafted web content may trigger an unexpected Safari crash. Apple addressed the issue with improved memory handling in iOS 18.7.10 and iPadOS 18.7.10. The flaw is classified as a memory buffer error [CWE-119] and requires user interaction over the network to exploit. Successful exploitation results in limited availability impact without compromising confidentiality or integrity.

Critical Impact
Remote attackers can crash Safari on unpatched iOS and iPadOS devices by luring users to malicious web content, disrupting browser availability.

Affected Products

Apple iOS versions prior to 18.7.10
Apple iPadOS versions prior to 18.7.10
Safari browser on affected iOS and iPadOS builds

Discovery Timeline

2026-08-17 - CVE-2026-28984 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-28984

Vulnerability Analysis

The vulnerability resides in Safari's web content processing logic within iOS and iPadOS. When Safari parses specially crafted HTML, JavaScript, or related web resources, improper memory handling causes the process to terminate unexpectedly. The flaw is categorized under [CWE-119] as an improper restriction of operations within the bounds of a memory buffer. Apple's advisory confirms the issue is fixed through improved memory handling routines. Exploitation impacts availability only, with no direct path to code execution or data disclosure documented in the vendor advisory.

Root Cause

The root cause is improper memory handling in Safari's rendering pipeline when it processes attacker-supplied web content. Apple's fix in iOS 18.7.10 and iPadOS 18.7.10 tightens memory boundary checks. The associated weakness class [CWE-119] typically involves reads or writes outside allocated memory regions, which in this case results in a browser crash rather than arbitrary code execution.

Attack Vector

An attacker hosts malicious web content on a controlled server or injects it into a compromised site. The victim must interact by visiting the URL through Safari on an affected device. No authentication is required. The crash disrupts the user's browsing session and can be triggered repeatedly to sustain denial of service against Safari on the target device.

See the Apple Support Article for vendor-authored technical details.

Detection Methods for CVE-2026-28984

Indicators of Compromise

Repeated unexpected Safari crashes on iOS or iPadOS devices coinciding with visits to specific URLs
Crash reports referencing WebKit or Safari rendering components in device diagnostics
Mobile device management (MDM) telemetry showing Safari process terminations across multiple users after visiting the same domain

Detection Strategies

Correlate Safari crash logs from iOS device diagnostics with web proxy or DNS logs to identify triggering URLs
Monitor MDM and endpoint telemetry for iOS and iPadOS builds below 18.7.10 to identify exposed devices
Inspect network traffic for suspicious payloads delivered to WebKit-based clients, particularly HTML or JavaScript with abnormal structures

Monitoring Recommendations

Enable device analytics collection on managed iOS and iPadOS fleets to capture Safari crash traces
Track browser version and OS build compliance through MDM reporting dashboards
Alert on repeated crash events tied to a single domain or URL pattern across multiple endpoints

How to Mitigate CVE-2026-28984

Immediate Actions Required

Update all iOS devices to version 18.7.10 and all iPadOS devices to version 18.7.10 as documented in the Apple Support Article
Push update policies through MDM to enforce compliance across managed fleets
Advise users to avoid untrusted links and unfamiliar websites until patching completes

Patch Information

Apple released fixes in iOS 18.7.10 and iPadOS 18.7.10 that address the memory handling defect. Administrators should validate patch deployment through MDM inventory reports and confirm that Safari operates on the patched WebKit build. Refer to the Apple Support Article for full advisory details and download guidance.

Workarounds

Restrict Safari usage on unpatched devices by directing users to alternative managed browsers where feasible
Deploy web content filtering to block known malicious domains delivering crafted payloads
Enable Lockdown Mode on high-risk devices to reduce the attack surface exposed to malicious web content

bash

# Verify iOS or iPadOS build compliance via MDM query (example)
# Confirm devices report Product Version 18.7.10 or later
mdm-cli query --attribute ProductVersion --min-version 18.7.10