Product:
Safari
Summary
The issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to an unexpected process crash. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2026-28857 |
Exploitation
An attacker can exploit this vulnerability by crafting malicious web content that, when processed by the affected version of Safari, can lead to a crash of the application. This requires the user to interact with the malicious content, making user interaction a necessary component of the exploit.
Affected Products
- Safari: A web browser that may crash when processing maliciously crafted web content.
- iOS: The mobile operating system that includes Safari and is affected by the same vulnerability.
- iPadOS: The operating system for iPads that also includes Safari and is vulnerable.
- macOS Tahoe: The desktop operating system that includes Safari and is impacted by this issue.
- visionOS: The operating system for Apple Vision devices that is also affected.
Mitigation
To mitigate this vulnerability, users should update their Safari browser and associated operating systems to the latest versions where the issue has been addressed. Regularly updating software can help protect against known vulnerabilities.