WebKit CVE-2026-28913

Exploitation requires the victim to actively load malicious web content in Safari or any application using WebKit rendering engine (email clients, in-app browsers, RSS readers, etc.). The CVSS vector indicates PR:N (no privileges required on the target system) and AV:N (network accessible), but despite UI:N in the vector, the vendor description and attack nature inherently require user interaction to navigate to or render the malicious content. No special browser configuration, disabled security features, or non-default settings required - vulnerability affects default WebKit installations. Attack succeeds against all unpatched Apple operating systems (iOS/iPadOS, macOS, tvOS, watchOS) running versions below 26.5. Exploitation is limited by the need for user-initiated content loading, though this can be achieved through phishing, malicious advertisements, compromised legitimate sites, or watering hole attacks targeting specific user populations.

Real-world risk appears moderate despite the high CVSS base score of 7.5. Critical discrepancy exists between CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicating high confidentiality impact with no user interaction) and vendor description (stating only process crash/availability impact, which logically requires user interaction to load malicious web content). The CVSS vector appears misconfigured - expected vector should be AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H for web content requiring user to visit a page. EPSS score of 0.02% (5th percentile) indicates security researchers assess this as low exploitation probability in the wild. No CISA KEV listing confirms no active exploitation detected. No public POC identified. SSVC decision factors: exploitation status is none, automatable is no (requires user to load content), technical impact is partial (DoS only per vendor). Priority assessment: Medium-Low for most organizations - patch during normal maintenance cycles. Higher priority for high-visibility targets where browser-based DoS could impact critical operations, or environments where WebKit is used in kiosks/embedded systems. The buffer overflow classification (CWE-119) raises theoretical concern that the flaw could potentially be exploited beyond DoS if chained with other techniques, though vendor assessment indicates only crash impact was demonstrated.

An attacker hosts maliciously crafted web content on a compromised or attacker-controlled website, embedding specially formatted HTML, CSS, JavaScript, or multimedia elements designed to trigger the WebKit memory handling flaw. A user on an unpatched iOS, macOS, tvOS, or watchOS device visits the malicious page through Safari or any application using WebKit for web rendering (email clients displaying HTML, in-app browsers, etc.). The crafted content triggers out-of-bounds memory access during parsing or rendering, causing the WebKit process to crash and terminating the browsing session or application, resulting in denial of service. No public proof-of-concept code identified at time of analysis.