This vulnerability (CVE-2026-28947) is a use-after-free issue in WebKitGTK caused by improper memory management when processing malicious web content. It can lead to unexpected process crashes, including Safari crashes, and may allow remote code execution due to heap corruption. The vulnerability affects graphical applications using WebKitGTK to render web content, such as GNOME components. Red Hat has released security updates for affected packages in Red Hat Enterprise Linux 9.2. Mitigation involves applying these updates or removing packages that depend on WebKitGTK4 if feasible. The vulnerability has a CVSS v3.1 base score of 8.8 (high severity) with network attack vector, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can cause denial of service via process crashes and may lead to remote code execution due to memory corruption. Confidentiality, integrity, and availability impacts are all rated high. The vulnerability affects applications that use WebKitGTK to process web content, potentially exposing sensitive information or allowing unauthorized code execution if exploited.

A fix is available and has been released in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5, and Red Hat Enterprise Linux 9.2 packages. Users should apply these official updates promptly. Additionally, avoid processing or loading untrusted web content with WebKitGTK. For Red Hat systems, consider removing packages that depend on WebKitGTK4 if they are not required, noting that removing some packages may break GNOME functionality. WebKitGTK3 can be removed without consequence. The vendor manages remediation for these products, and users should follow vendor advisories for update instructions.