CVE-2026-28979: Apple Safari Out-of-Bounds Access Denial of Service

Technical summary

CVE-2026-28979 is an out-of-bounds access vulnerability (CWE-125: Out-of-bounds Read, CWE-787: Out-of-bounds Write) in Apple's WebKit rendering engine used by Safari and embedded in iOS, iPadOS, and macOS. The flaw arises from inadequate bounds validation during web content processing. An attacker can craft malicious HTML, JavaScript, or media content that triggers memory access beyond allocated buffers. While the CVSS vector indicates no confidentiality or integrity impact (C:N/I:N), the availability impact is rated high (A:H), confirming the primary threat is process termination. The attack requires no authentication or special privileges (PR:N) and relies on user interaction—specifically visiting a malicious website (UI:R).

Business impact

For organizations managing fleets of Apple devices—whether company-owned laptops, iPhones, or iPads—this vulnerability introduces availability risk. Employees browsing compromised or attacker-controlled websites may experience unexpected application crashes, disrupting productivity. The impact is typically short-lived (users can relaunch Safari) but repeated crashes degrade user experience and may indicate active exploitation campaigns. Industries reliant on web-based workflows (finance, customer service, research) face minor but measurable operational friction. Enterprise MDM deployments should prioritize patch deployment to prevent support ticket volume from denial-of-service incidents.

Affected systems

Safari 26.5.2 and earlier versions on macOS Tahoe are vulnerable. iOS 26.5.2 and earlier, iPadOS 26.5.2 and earlier versions are affected. tvOS versions prior to 26.6, visionOS prior to 26.6, and watchOS prior to 26.6 are also vulnerable. Any Apple platform that uses the WebKit rendering engine is potentially impacted, though severity varies by use case—Safari on macOS and iOS represents the highest-risk vector due to frequent web browsing. Third-party browsers on iOS and iPadOS that rely on WebKit (per App Store requirements) may also be affected; verify vendor advisories.

Exploitability

The vulnerability carries moderate exploitability risk. Attack vector is network-based (AV:N) and requires low complexity (AC:L), meaning exploitation does not demand sophisticated techniques or race conditions. However, user interaction is mandatory (UI:R)—the user must visit a malicious website or click a link. No in-the-wild exploitation has been confirmed as of the advisory publication (not listed on CISA KEV). The barrier to craft a working proof-of-concept is likely moderate for skilled browser vulnerability researchers but not trivial. Opportunistic attackers via ad networks, watering holes, or phishing campaigns could weaponize this to trigger crashes at scale, though the denial-of-service impact limits appeal compared to remote code execution flaws.

Remediation

Apply the following patches: Safari 26.5.2 or later on macOS Tahoe, iOS 26.5.2 or later, iPadOS 26.5.2 or later, tvOS 26.6 or later, visionOS 26.6 or later, and watchOS 26.6 or later. For macOS, enable automatic updates or download patches via System Settings > General > Software Update. On iOS/iPadOS, use Settings > General > Software Update. Verify patch deployment through MDM solutions by confirming OS build versions match or exceed the fixed versions listed above.

Patch guidance

Patches are available and should be deployed immediately to macOS Tahoe, iOS, and iPadOS user populations. Test patch rollout on a small population of non-critical devices first to ensure compatibility with business applications. Organizations with older macOS versions (pre-Tahoe) should verify whether patches are provided; consult Apple Security Updates page for extended-support details. For enterprise deployments, use Mobile Device Management tools to enforce OS updates and restrict access to unpatched devices where possible. Establish a 30-day target for full deployment given the medium CVSS score and non-exploited status.

Detection guidance

Monitor system logs and crash reports for repeated Safari or WebKit-related process terminations correlated with web browsing activity. On macOS, examine Console.app for crashes in Safari or WebKit processes with memory access violations. iOS/iPadOS administrators can review MDM-collected diagnostic data for crash logs. Network detection is challenging since the attack is triggered by visiting a website; however, if you operate a Security Gateway, monitor for sudden spikes in connections to known malicious domains or newly registered domains with suspicious patterns. Establish a baseline of normal crash rates and alert on anomalies. Check for indicators of watering hole attacks targeting your industry vertical.

Why prioritize this

This vulnerability merits prompt but not emergency attention. The CVSS score of 6.5 (Medium) reflects high availability impact but absence of confidentiality or integrity compromise. The lack of confirmed exploitation (not on CISA KEV) reduces urgency compared to actively exploited flaws. However, the low attack complexity and user-centric network vector mean widespread availability disruptions are plausible if malicious sites proliferate. Organizations with heavy macOS/iOS user bases and open web browsing policies should prioritize this in the next 30 days. Those with stricter controls (managed endpoints, content filtering) can extend timelines slightly but should not defer beyond 60 days.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a medium-severity denial-of-service vulnerability with no data exfiltration or system compromise vector. The score weights the mandatory user interaction (UI:R) against the low attack complexity and network-based delivery. Confidentiality and Integrity metrics are unimpacted (C:N/I:N), but Availability is High (A:H), signaling process crashes. The Scope metric (S:U) confirms the impact is limited to the user's own browser session, not multi-user systems. This severity is appropriate for a reliability issue rather than a privilege-escalation or memory-corruption flaw enabling code execution.

Frequently asked questions