Skip to main content

WebKit CVE-2026-28883

| EUVDEUVD-2026-29224 HIGH
Use After Free (CWE-416)
2026-05-11 apple GHSA-hwcr-g58m-97q5
Denial Of Service Use After Free Memory Corruption Apple Tvos Visionos Watchos Ios And Ipados
7.5
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Victim visits attacker-controlled website
  2. Delivery
    WebKit processes malicious web content
  3. Exploit
    Use-after-free triggered in memory management
  4. Execution
    Access to deallocated memory region
  5. Impact
    Information disclosure from adjacent memory

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

No special conditions - remote unauthenticated exploitation against default configurations of WebKit on iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network accessibility with low attack complexity, no required privileges, and no user interaction beyond normal web browsing. The vulnerability triggers during standard web content processing when malicious HTML, CSS, or JavaScript is rendered by WebKit. Exploitation works through Safari browser, in-app WebViews (used by Mail, Messages, third-party apps), and any component leveraging WebKit for rendering. No non-default configuration settings, special features, or elevated permissions required. The only limiting factor is platform version - devices already updated to 26.5 are not vulnerable. The description's mention of 'processing maliciously crafted web content' confirms the trigger is content characteristics rather than user actions or deployment configurations.
Impact

CRITICAL DATA CONFLICT DETECTED: The CVE description states 'may lead to an unexpected process crash' (availability impact), but the CVSS vector indicates CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - high confidentiality impact with NO availability impact. This is a fundamental scoring inconsistency that must be resolved with Apple before accurate risk assessment. If the CVSS vector is authoritative, this enables remote unauthenticated information disclosure from memory, potentially leaking credentials, session tokens, or cross-origin data - a critical privacy and security risk across billions of Apple devices. If the description is authoritative, this is a remote denial-of-service causing Safari/WebView crashes - still serious but lower strategic impact. The AV:N/AC:L/PR:N/UI:N metrics indicate trivial exploitation (network-accessible, low complexity, no authentication), yet EPSS score of 0.02% suggests security community assesses actual exploitation probability as very low. This low EPSS despite favorable attack conditions may indicate: (1) rapid patch adoption in Apple's ecosystem, (2) additional undocumented exploitation barriers, or (3) limited attacker interest in information disclosure versus code execution. Not present in CISA KEV. Patch available from vendor reduces ongoing risk. SSVC assessment: exploitation status is none public, automatable is yes (no user interaction), technical impact depends on resolution of CVSS/description conflict. Real-world priority is MEDIUM pending clarification - the network vector and device ubiquity warrant attention, but absent active exploitation and with patches available, this does not demand emergency response.
Exploit ScenarioDerived

An attacker hosts a specially crafted malicious web page containing HTML, CSS, or JavaScript designed to trigger the use-after-free condition in WebKit's content processing engine. When a user on an unpatched Apple device visits the page through Safari, clicks a malicious link in Messages or Mail that opens a WebView, or encounters the content in any app using WebKit rendering, the vulnerability automatically triggers without requiring further user interaction. The use-after-free causes WebKit to access deallocated memory regions, potentially exposing sensitive information from adjacent memory such as authentication tokens, browsing history, or data from other tabs. No publicly available exploit code exists at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 12, 2026

Use-after-free in WebKit across Apple's entire operating system ecosystem enables remote information disclosure via malicious web content. Affects iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions prior to 26.5. The vulnerability allows network-based unauthenticated attackers to access high-value confidential information through crafted web pages, though the CVE description anomalously mentions process crash (availability impact) while the CVSS vector indicates confidentiality impact only. No public exploit identified at time of analysis. EPSS score of 0.02% (5th percentile) suggests low likelihood of imminent widespread exploitation despite the broad platform impact and network attack vector.

RemediationAI

Update all affected Apple devices to the patched versions: iOS and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Apple has released fixes addressing the improved memory management across all platforms simultaneously. Specific update procedures and release notes are available in Apple security advisories HT127110, HT127115, HT127118, HT127119, and HT127120 at https://support.apple.com/en-us/. For enterprise environments unable to immediately deploy OS updates, interim mitigations include restricting web browsing to trusted sites via Mobile Device Management (MDM) policies, disabling JavaScript in Safari (Settings → Safari → Advanced → JavaScript), or using Content Filter policies to block untrusted domains. Note that disabling JavaScript significantly impacts web application functionality and user experience. Network-level web filtering can provide defense-in-depth but does not prevent exploitation from allowed domains. For devices that cannot be updated (legacy hardware, mission-critical systems with change restrictions), consider isolating from untrusted networks and restricting web access to essential services only until upgrade paths are available.

Affected VersionsENISA

visionOS 0 <26.5
macOS 0 <26.5
watchOS 0 <26.5
tvOS 0 <26.5
iOS and iPadOS 0 <26.5

Affected Packages

euvd ios_and_ipados fix: 26.5
euvd macos fix: 26.5
euvd tvos fix: 26.5
euvd visionos fix: 26.5
euvd watchos fix: 26.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This is a CWE-416 use-after-free vulnerability in WebKit, Apple's browser engine that powers Safari and in-app web views across all Apple platforms. Use-after-free occurs when code continues to use a memory pointer after the referenced object has been deallocated, potentially exposing sensitive data from adjacent memory regions or causing crashes. The vulnerability resides in WebKit's web content processing pipeline - the component responsible for parsing, rendering, and executing web page elements (HTML, CSS, JavaScript). Given the cross-platform nature (iOS/iPadOS, macOS, tvOS, visionOS, watchOS), the flaw exists in shared WebKit codebase rather than platform-specific implementations. The CVSS vector specifies network attack vector with low complexity and no required privileges or user interaction, indicating the vulnerability triggers automatically during normal web content processing without requiring victim action beyond loading a page.

Know when Tvos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
CVSS changed
May 12, 2026 - 14:22 NVD
7.5 (HIGH)
Patch available
May 11, 2026 - 22:03 EUVD
CVE Published
May 11, 2026 - 20:08 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 20:08 nvd
HIGH 7.5

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Executive ViewAI

Why It Matters

CVE-2026-28883 is a use-after-free vulnerability in WebKit affecting Apple's entire operating system portfolio (iOS, iPadOS, macOS Tahoe, tvOS, visionOS, watchOS) that allows unauthenticated remote attackers to disclose confidential information through malicious web content. This vulnerability poses a data confidentiality risk across consumer devices and potentially enterprise-owned Apple infrastructure, requiring immediate patching to prevent unauthorized information access via web browsing.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible, restrict affected devices from accessing untrusted websites and implement network-level web content filtering; however, these mitigations are interim only and patching remains mandatory.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28883 ADVISORY https://vuldb.com/vuln/362804 REF https://access.redhat.com/errata/RHSA-2026:25918 REF https://access.redhat.com/errata/RHSA-2026:25927 REF https://access.redhat.com/errata/RHSA-2026:27728 REF https://access.redhat.com/errata/RHSA-2026:27785 REF https://access.redhat.com/errata/RHSA-2026:27804 REF https://access.redhat.com/errata/RHSA-2026:28114 REF https://access.redhat.com/errata/RHSA-2026:28146 REF https://access.redhat.com/errata/RHSA-2026:28147 REF https://access.redhat.com/errata/RHSA-2026:28148 REF https://access.redhat.com/security/cve/CVE-2026-28883 REF https://bugzilla.redhat.com/show_bug.cgi?id=2483956 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28883.json REF https://support.apple.com/en-us/127110 REF https://support.apple.com/en-us/127115 REF https://support.apple.com/en-us/127118 REF https://support.apple.com/en-us/127119 REF https://support.apple.com/en-us/127120 REF https://support.apple.com/en-us/127121

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy