Product:
iOS, iPadOS, macOS, tvOS, visionOS, watchOS
Summary
The issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to an unexpected process crash. This vulnerability affects multiple Apple operating systems and requires user interaction to exploit.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-28953 |
Exploitation
An attacker can exploit this vulnerability by crafting malicious web content that, when processed by the affected Apple operating systems, can lead to a crash of the process. This can be done remotely over a network, making it relatively easy for an attacker to target users without requiring any special privileges or user interaction.
Affected Products
- iOS 18.7.9 and later: Affected by memory handling issues leading to potential crashes.
- iPadOS 18.7.9 and later: Similar vulnerabilities as iOS affecting iPad devices.
- macOS Tahoe 26.5 and later: Vulnerable to the same memory handling issues.
- tvOS 26.5 and later: Affected by the same web content processing vulnerabilities.
- visionOS 26.5 and later: Vulnerable to crashes from malicious web content.
- watchOS 26.5 and later: Similar vulnerabilities affecting Apple Watch devices.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of the affected operating systems. Apple has released updates that address the memory handling issues, and applying these updates will help protect against potential exploitation.