Product:
iOS, iPadOS, macOS, tvOS, visionOS, watchOS
Summary
The issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to an unexpected process crash. This issue is fixed in the latest versions of the affected products.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-28901 |
Exploitation
An attacker can exploit this vulnerability by crafting malicious web content that, when processed by the affected system, can lead to a crash of the process. User interaction is required, as the user must visit a specially crafted website or open a malicious file to trigger the vulnerability.
Affected Products
- iOS 26.5: Mobile operating system for iPhone and iPod touch.
- iPadOS 26.5: Operating system for iPad devices.
- macOS Tahoe 26.5: Operating system for Mac computers.
- tvOS 26.5: Operating system for Apple TV.
- visionOS 26.5: Operating system for Vision devices.
- watchOS 26.5: Operating system for Apple Watch.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of the affected operating systems. Regularly applying updates and patches can help protect against similar vulnerabilities in the future.