Skip to main content

Apple WebKit CVE-2026-28953

| EUVDEUVD-2026-29258 HIGH
Buffer Overflow (CWE-119)
2026-05-11 apple GHSA-53qj-jrj4-cjhh
Buffer Overflow Apple Tvos Visionos Watchos Ios And Ipados
7.5
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker hosts malicious website
  2. Delivery
    Victim loads crafted web content
  3. Exploit
    WebKit parses malicious payload
  4. Execution
    Buffer overflow triggers out-of-bounds memory read
  5. Persist
    Sensitive data leaked from adjacent memory
  6. Impact
    Attacker exfiltrates disclosed information

Vulnerability Assessment

Weakness
CWE
CWE-119
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Remote exploitation against default WebKit configurations on any affected Apple platform when processing web content from any network-accessible source. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no non-default configuration, and no user interaction beyond normal web browsing is required. Exploitation occurs automatically during web content parsing in Safari browser, in-app WebKit views, or any application utilizing the WebKit engine. The vulnerability is NOT limited to specific features, protocols, or deployment modes - all WebKit instances on vulnerable OS versions are exploitable. Exploitation requires only that the victim device load attacker-controlled web content, achievable through direct website visits, embedded iframes, redirects, or web-based application components. However, exploitation impact is limited to memory disclosure (confidentiality breach) rather than arbitrary code execution based on CVSS impact metrics, though Apple's 'process crash' description suggests potential denial-of-service outcomes not reflected in the CVSS availability rating.
Impact

The CVSS base score of 7.5 (High) reflects the ease of exploitation (AV:N/AC:L/PR:N/UI:N) but must be contextualized against limited real-world risk signals. The attack vector is network-based with low complexity and no prerequisites, meaning any website can potentially trigger this vulnerability when visited by affected Apple devices. However, the CVSS impact metrics (C:H/I:N/A:N) indicate pure information disclosure rather than the code execution or system compromise typically prioritized by attackers. The EPSS score of 0.03% (10th percentile) suggests minimal observed exploitation activity, likely because memory disclosure alone offers limited attack value compared to RCE vulnerabilities. No CISA KEV listing confirms no widespread exploitation despite the trivial attack prerequisites. SSVC factors indicate: exploitation is theoretically automatable (no user interaction required per CVSS UI:N), technical impact is limited to partial confidentiality breach, and no active exploitation confirmed. The conflict between Apple's 'process crash' description and CVSS availability impact (A:N) creates uncertainty about the true attack outcome. Priority should be MEDIUM for client devices with web browsing capability, elevated to HIGH for environments handling sensitive data where memory disclosure poses regulatory or competitive risk. Patch availability across all platforms and the unauthenticated network vector justify prompt but not emergency patching unless threat intelligence indicates active targeting of Apple ecosystem vulnerabilities.
Exploit ScenarioDerived

An attacker hosts a malicious website containing specially crafted HTML, CSS, or JavaScript designed to trigger buffer overflow conditions in WebKit's content parsing engine. When a victim using an unpatched Apple device visits this site or clicks a link (including through phishing, malvertising, or watering hole attacks), WebKit processes the malicious content without requiring any user interaction beyond the initial page load. The buffer overflow allows the attacker to read adjacent memory regions, potentially exposing sensitive data such as authentication tokens, session cookies, or recently accessed content from other browser tabs. Because no public POC exists at time of analysis, the specific exploitation technique remains unconfirmed.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 12, 2026

Information disclosure in Apple WebKit's web content processing engine allows remote attackers to read sensitive memory contents via maliciously crafted web pages. This buffer overflow vulnerability (CWE-119) affects all major Apple platforms including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS prior to their respective patched versions. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates trivial network-based exploitation requiring no authentication or user interaction, though the impact is limited to confidentiality (C:H/I:N/A:N) rather than the process crash described by Apple. EPSS score of 0.03% (10th percentile) suggests low observed exploitation probability despite the ease of exploitation. No CISA KEV listing or public POC identified at time of analysis. Apple has released patches across all affected platforms.

RemediationAI

Apply vendor-released patches immediately through each platform's standard update mechanism: upgrade iOS and iPadOS to version 18.7.9 or 26.5, macOS Tahoe to 26.5, tvOS to 26.5, visionOS to 26.5, and watchOS to 26.5 as detailed in Apple security advisories HT127110, HT127111, HT127115, HT127118, HT127119, and HT127120 available at https://support.apple.com/en-us/127110 through https://support.apple.com/en-us/127120. For environments unable to patch immediately, implement network-layer content filtering to block access to untrusted websites and disable JavaScript in Safari/WebKit-based browsers, though this significantly degrades web functionality and user experience. Consider application allowlisting to restrict web content to trusted domains only, recognizing this may be impractical for general-purpose devices. Enterprise mobile device management (MDM) solutions should enforce automatic updates and restrict unapproved app installations that embed WebKit views. No viable workaround exists for the core vulnerability without disabling web browsing capability entirely.

Affected VersionsENISA

macOS 0 <26.5
visionOS 0 <26.5
iOS and iPadOS 0 <18.7.9
watchOS 0 <26.5
iOS and iPadOS 0 <26.5
tvOS 0 <26.5

Affected Packages

euvd ios_and_ipados fix: 18.7.9, 26.5
euvd macos fix: 26.5
euvd tvos fix: 26.5
euvd visionos fix: 26.5
euvd watchos fix: 26.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects Apple's WebKit browser engine, the core rendering component used across all Apple operating systems for Safari and in-app web views. CWE-119 (Improper Restriction on Operations within Memory Buffer Bounds) represents a classic buffer overflow class where insufficient bounds checking allows memory access beyond allocated regions. Apple's description mentions 'improved memory handling' and 'unexpected process crash', suggesting the flaw occurs during parsing or rendering of web content when buffer size calculations fail. However, the CVSS vector (C:H/I:N/A:N) indicates high confidentiality impact with no availability impact, contradicting the 'process crash' description and suggesting the primary risk is information disclosure through out-of-bounds memory reads rather than denial of service. This discrepancy requires verification with Apple's security advisories. The CPE entries confirm impact across the entire Apple ecosystem: iOS/iPadOS (mobile), macOS (desktop), tvOS (streaming), visionOS (spatial computing), and watchOS (wearable).

Know when Tvos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
CVSS changed
May 12, 2026 - 14:22 NVD
7.5 (HIGH)
Patch available
May 11, 2026 - 22:18 EUVD
CVE Published
May 11, 2026 - 20:07 nvd
UNKNOWN (no severity yet)
CVE Published
May 11, 2026 - 20:07 nvd
HIGH 7.5

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Executive ViewAI

Why It Matters

Apple WebKit contains a high-severity information disclosure vulnerability affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS that allows remote attackers to extract sensitive memory contents through maliciously crafted web pages without user authentication or interaction. This vulnerability poses significant risk to organizations with large Apple device deployments, particularly those handling sensitive data, as attackers can passively harvest confidential information by hosting or injecting malicious web content.

Business Impact: High
Compensating Controls

Apply vendor patch. Until patches deploy: restrict affected devices from accessing untrusted websites and external web content; isolate high-value systems from internet-facing web browsing; implement content filtering to block known malicious domains; monitor for anomalous memory access patterns if threat detection tools support Apple platforms.

Threat Intelligence Overview

EPSS Score
0.0%
Top 90% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Tvos

View all
CVE-2022-2294 HIGH
8.8 Jul 28

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
CVE-2017-13861 HIGH POC
7.8 Dec 25

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2016-4669 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2017-2370 HIGH POC
7.8 Feb 20

An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28953 ADVISORY https://vuldb.com/vuln/362819 REF https://access.redhat.com/errata/RHSA-2026:25918 REF https://access.redhat.com/errata/RHSA-2026:25927 REF https://access.redhat.com/errata/RHSA-2026:27728 REF https://access.redhat.com/errata/RHSA-2026:27785 REF https://access.redhat.com/errata/RHSA-2026:27804 REF https://access.redhat.com/errata/RHSA-2026:28114 REF https://access.redhat.com/errata/RHSA-2026:28146 REF https://access.redhat.com/errata/RHSA-2026:28147 REF https://access.redhat.com/errata/RHSA-2026:28148 REF https://access.redhat.com/security/cve/CVE-2026-28953 REF https://bugzilla.redhat.com/show_bug.cgi?id=2483965 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28953.json REF https://support.apple.com/en-us/127110 REF https://support.apple.com/en-us/127111 REF https://support.apple.com/en-us/127115 REF https://support.apple.com/en-us/127118 REF https://support.apple.com/en-us/127119 REF https://support.apple.com/en-us/127120 REF https://support.apple.com/en-us/127121

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy