Product:
iOS, iPadOS, macOS, tvOS, visionOS, watchOS
Summary
The issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to an unexpected process crash. This issue is fixed in the latest versions of the affected products.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2026-28902 |
Exploitation
An attacker can exploit this vulnerability by crafting malicious web content that, when processed by the affected systems, can lead to a crash of the process. User interaction is required, as the user must visit a specially crafted website or open a malicious file to trigger the vulnerability.
Affected Products
- iOS 26.5: Latest version addressing the memory handling issue.
- iPadOS 26.5: Updated to fix the vulnerability related to web content processing.
- macOS Tahoe 26.5: Includes improvements to prevent unexpected crashes.
- tvOS 26.5: Enhanced memory handling to mitigate the issue.
- visionOS 26.5: Updated to address the vulnerability.
- watchOS 26.5: Fixed the issue with improved memory management.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Regularly applying updates will help protect against potential exploits.