Skip to main content

WebKit CVE-2026-28947

| EUVDEUVD-2026-29255 HIGH
Use After Free (CWE-416)
2026-05-11 apple GHSA-52pv-8487-c6jp
Denial Of Service Use After Free Memory Corruption Apple Tvos Visionos Watchos Ios And Ipados
8.8
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Victim receives phishing message with URL
  2. Delivery
    Clicks link opening Safari/WebKit
  3. Exploit
    Malicious webpage loaded
  4. Execution
    JavaScript triggers use-after-free
  5. Persist
    Memory corruption achieved
  6. Impact
    Safari crash or code execution

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

User must visit a malicious or compromised website hosting specially crafted web content (CVSS UI:R confirms required user interaction). Exploitation succeeds against default Safari configurations and any application using WebKit rendering engine on vulnerable platform versions (iOS/iPadOS/macOS/tvOS/visionOS/watchOS below 26.5). No special browser settings, disabled security features, or non-default configurations required-the vulnerability exists in standard WebKit installations. Exploitation is limited by the need for user action (clicking link, typing URL, or automatic preview rendering in messaging apps) and potential exploit reliability challenges inherent to use-after-free memory corruption, where heap state variations across devices may affect success rates. The network attack vector (AV:N) combined with no authentication requirement (PR:N) means any internet-hosted content can attempt exploitation, but the user interaction barrier prevents fully automated mass exploitation.
Impact

CVSS 8.8 indicates high severity with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R). The vector suggests confidentiality, integrity, and availability impacts all rated High (C:H/I:H/A:H), theoretically enabling full system compromise. However, real-world risk signals paint a different picture: EPSS score of 0.02% (5th percentile) indicates negligible observed exploitation probability in the wild. No CISA KEV listing confirms absence of known active exploitation campaigns. The discrepancy between CVSS theoretical impact and EPSS real-world probability likely stems from exploitation complexity-while CVSS rates AC:L, successful use-after-free exploitation requires sophisticated heap manipulation techniques beyond simple proof-of-concept crashes. The description mentions 'unexpected Safari crash' as the observed impact, suggesting Apple's testing demonstrated denial-of-service rather than confirmed code execution, though the latter remains theoretically possible. Patch availability across all platforms significantly reduces risk for organizations with active patch management. Priority should be moderate-high: the user interaction requirement and lack of observed exploitation lower urgency compared to network-wormable flaws, but the cross-platform scope and theoretical RCE potential warrant timely patching within standard maintenance windows.
Exploit ScenarioDerived

Attacker hosts a weaponized webpage containing specially crafted HTML, CSS, or JavaScript designed to trigger the use-after-free condition in WebKit's memory management. Victim visits the malicious site through Safari or clicks a link in a messaging app that renders preview content via WebKit. The crafted web content causes WebKit to free a memory object while retaining a reference to it, then manipulates heap state to control the freed region's contents. In the minimal exploitation case, this produces a Safari crash (denial-of-service). In advanced scenarios with heap spraying techniques, the attacker could redirect execution flow to injected shellcode, achieving arbitrary code execution with Safari's privileges and potentially accessing user data, credentials, or camera/microphone resources.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 12, 2026

Use-after-free in WebKit allows remote attackers to trigger Safari crashes and potentially achieve arbitrary code execution across Apple's entire ecosystem (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) via maliciously crafted web content. Users must visit or be tricked into visiting a malicious webpage (UI:R). Despite CVSS 8.8 (High) with theoretical code execution impact (C:H/I:H/A:H), EPSS probability is extremely low (0.02%, 5th percentile), indicating minimal observed exploitation activity. No public exploit identified at time of analysis, and vendor patches are available across all platforms as of version 26.5.

RemediationAI

Apply vendor-released patches by upgrading to version 26.5 or later for all affected platforms: iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Installation instructions and download links are available through Apple's support pages (references listed above) or through standard over-the-air update mechanisms on each device. For environments unable to immediately patch, implement compensating controls: deploy web filtering to block access to known-malicious domains, restrict Safari/WebKit usage to trusted sites only via Mobile Device Management (MDM) policies on iOS/iPadOS, or temporarily switch to alternative browsers on macOS (though this breaks application integration dependencies). Note that blocking all web content significantly impacts user productivity, and alternative browsers on iOS still use WebKit rendering engine per Apple's App Store requirements, limiting mitigation effectiveness. Short-term workarounds are impractical for most organizations-prioritize rapid patch deployment instead.

Affected VersionsENISA

visionOS 0 <26.5
watchOS 0 <26.5
macOS 0 <26.5
iOS and iPadOS 0 <26.5
tvOS 0 <26.5

Affected Packages

euvd ios_and_ipados fix: 26.5
euvd macos fix: 26.5
euvd tvos fix: 26.5
euvd visionos fix: 26.5
euvd watchos fix: 26.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects WebKit, Apple's browser engine underlying Safari and in-app web views across all Apple platforms. The root cause is CWE-416 (Use-After-Free), a memory corruption class where code references memory after it has been freed, creating a dangling pointer. In WebKit's case, this occurs during processing of web content-likely in the HTML parser, JavaScript engine, or DOM manipulation code. Use-after-free bugs are particularly dangerous because attackers can control the freed memory region through heap spraying or grooming techniques, potentially redirecting program execution. The CPE strings (cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, etc.) confirm this affects WebKit implementations across iOS/iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS prior to version 26.5. The simultaneous patching across all Apple platforms indicates a shared WebKit codebase vulnerability rather than platform-specific issues.

Know when Tvos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
May 12, 2026 - 18:22 NVD
8.8 (HIGH)
Patch available
May 11, 2026 - 22:03 EUVD
CVE Published
May 11, 2026 - 20:08 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 20:08 nvd
HIGH 8.8

DescriptionCVE.org

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Executive ViewAI

Why It Matters

CVE-2026-28947 is a high-severity use-after-free vulnerability in WebKit affecting Safari across all Apple platforms (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) that could allow remote code execution through malicious web content. Despite theoretical code execution risk, exploitation probability remains extremely low (0.02% EPSS), and vendor patches are available across all affected platforms, significantly reducing organizational risk with timely deployment.

Business Impact: High
Compensating Controls

Apply vendor patch. For systems requiring interim mitigations pending update deployment: disable JavaScript in Safari settings where feasible, restrict browser access to trusted internal sites only, and enforce network-level content filtering to block known malicious domains.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28947 ADVISORY https://vuldb.com/vuln/362818 REF https://access.redhat.com/errata/RHSA-2026:25918 REF https://access.redhat.com/errata/RHSA-2026:25927 REF https://access.redhat.com/errata/RHSA-2026:27728 REF https://access.redhat.com/errata/RHSA-2026:27785 REF https://access.redhat.com/errata/RHSA-2026:27804 REF https://access.redhat.com/errata/RHSA-2026:28114 REF https://access.redhat.com/errata/RHSA-2026:28146 REF https://access.redhat.com/errata/RHSA-2026:28147 REF https://access.redhat.com/errata/RHSA-2026:28148 REF https://access.redhat.com/security/cve/CVE-2026-28947 REF https://bugzilla.redhat.com/show_bug.cgi?id=2483964 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28947.json REF https://support.apple.com/en-us/127110 REF https://support.apple.com/en-us/127115 REF https://support.apple.com/en-us/127118 REF https://support.apple.com/en-us/127119 REF https://support.apple.com/en-us/127120 REF https://support.apple.com/en-us/127121 REF https://support.apple.com/en-us/148287

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy