Skip to main content

WebKit CVE-2026-28883

| EUVDEUVD-2026-29224 HIGH
Use After Free (CWE-416)
2026-05-11 apple GHSA-hwcr-g58m-97q5
Denial Of Service Apple Use After Free Memory Corruption Ios And Ipados Tvos Visionos Watchos
7.5
CVSS 3.1 · Vendor: apple
Share

Severity by source

Vendor (apple) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE
HIGH
qualitative
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Generated
May 12, 2026 - 14:23 vuln.today
CVSS changed
May 12, 2026 - 14:22 NVD
7.5 (HIGH)
Patch available
May 11, 2026 - 22:03 EUVD
CVE Published
May 11, 2026 - 20:08 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 20:08 nvd
HIGH 7.5

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

AnalysisAI

Use-after-free in WebKit across Apple's entire operating system ecosystem enables remote information disclosure via malicious web content. Affects iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions prior to 26.5. The vulnerability allows network-based unauthenticated attackers to access high-value confidential information through crafted web pages, though the CVE description anomalously mentions process crash (availability impact) while the CVSS vector indicates confidentiality impact only. No public exploit identified at time of analysis. EPSS score of 0.02% (5th percentile) suggests low likelihood of imminent widespread exploitation despite the broad platform impact and network attack vector.

Technical ContextAI

This is a CWE-416 use-after-free vulnerability in WebKit, Apple's browser engine that powers Safari and in-app web views across all Apple platforms. Use-after-free occurs when code continues to use a memory pointer after the referenced object has been deallocated, potentially exposing sensitive data from adjacent memory regions or causing crashes. The vulnerability resides in WebKit's web content processing pipeline - the component responsible for parsing, rendering, and executing web page elements (HTML, CSS, JavaScript). Given the cross-platform nature (iOS/iPadOS, macOS, tvOS, visionOS, watchOS), the flaw exists in shared WebKit codebase rather than platform-specific implementations. The CVSS vector specifies network attack vector with low complexity and no required privileges or user interaction, indicating the vulnerability triggers automatically during normal web content processing without requiring victim action beyond loading a page.

RemediationAI

Update all affected Apple devices to the patched versions: iOS and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Apple has released fixes addressing the improved memory management across all platforms simultaneously. Specific update procedures and release notes are available in Apple security advisories HT127110, HT127115, HT127118, HT127119, and HT127120 at https://support.apple.com/en-us/. For enterprise environments unable to immediately deploy OS updates, interim mitigations include restricting web browsing to trusted sites via Mobile Device Management (MDM) policies, disabling JavaScript in Safari (Settings → Safari → Advanced → JavaScript), or using Content Filter policies to block untrusted domains. Note that disabling JavaScript significantly impacts web application functionality and user experience. Network-level web filtering can provide defense-in-depth but does not prevent exploitation from allowed domains. For devices that cannot be updated (legacy hardware, mission-critical systems with change restrictions), consider isolating from untrusted networks and restricting web access to essential services only until upgrade paths are available.

More in Ios And Ipados

View all
CVE-2026-43723 HIGH POC
7.8 Jul 27

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
CVE-2026-64771 CRITICAL
9.8 Jul 27

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
CVE-2026-43803 CRITICAL
9.8 Jul 27

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
CVE-2026-43810 CRITICAL
9.8 Jul 27

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
CVE-2026-64770 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
CVE-2026-64769 CRITICAL
9.8 Jul 27

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
CVE-2026-64774 CRITICAL
9.8 Jul 27

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
CVE-2026-64772 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
CVE-2026-43807 CRITICAL
9.8 Jul 27

Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
CVE-2026-64733 CRITICAL
9.8 Jul 27

A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
CVE-2026-43799 CRITICAL
9.8 Jul 27

Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se
CVE-2026-64700 CRITICAL
9.8 Jul 27

Local denial-of-service in Apple operating systems via a use-after-free vulnerability allows an app to cause unexpected

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

Share

CVE-2026-28883 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy