Apple Safari CVE-2026-28979

The sole prerequisite is that a user actively processes maliciously crafted web content - that is, visits or is redirected to an attacker-controlled URL in Safari, any iOS/iPadOS browser (all of which use WebKit on Apple platforms), or a macOS application embedding WKWebView. No authentication, no special configuration, and no privileged system access are required. Exploitation is limited by UI:R (the user must take an action, such as clicking a link or navigating to a URL), which prevents fully automated drive-by exploitation without user interaction. Non-default configurations do not affect exposure - any device running an affected Safari, iOS/iPadOS, or macOS version browsing the open web is within scope. Exploitation is further constrained by the confirmed impact being a process crash (DoS) rather than code execution, limiting attacker value to disruption rather than compromise.

CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects a remotely exploitable denial-of-service requiring only a single user interaction - visiting a malicious page. The attack complexity is low and no authentication is required, lowering the barrier to exploitation. However, the scope is ungrouped (S:U) and the confirmed impact is limited to an availability crash with no confidentiality or integrity compromise per vendor advisory, tempering the real-world severity below critical. Notably, the input tags include 'Information Disclosure' and 'Buffer Overflow,' which may hint at theoretical memory-leak potential inherent to OOB read primitives; however, the vendor description explicitly states only 'unexpected process crash' and the CVSS assigns C:N - this discrepancy is unresolved and defenders should monitor for updated vendor guidance. No EPSS score was provided in the intelligence feed. No CISA KEV listing and no public proof-of-concept have been identified, indicating this is not actively exploited at scale. This is a real but prioritized-moderate issue: patch promptly given Apple's ubiquitous install base, but there is no urgency signal suggesting active weaponization.

An attacker hosts a webpage containing specially crafted HTML, JavaScript, or embedded media designed to trigger the out-of-bounds read in WebKit's content parser. A target user is lured to this page via phishing email, malicious advertisement, or a compromised website, and upon the browser loading and rendering the content, the WebKit renderer process crashes, resulting in a browser tab or app termination. No public proof-of-concept exists at time of analysis, but the low attack complexity (AV:N/AC:L) means the vulnerability class is straightforward to reproduce once the vulnerable code path is identified.