CVE-2026-28847 is a vulnerability in Apple Safari and WebKitGTK+ where processing specially crafted web content can lead to an unexpected process crash due to improper memory handling (CWE-119, CWE-120). The issue affects Safari versions prior to 26.5 and related OS versions including iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. Red Hat has released security updates for WebKitGTK+ in Red Hat Enterprise Linux 7 Extended Lifecycle Support to address this issue. The vulnerability has a CVSS v3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

Successful exploitation of this vulnerability may cause Safari or WebKitGTK+-based browsers to crash unexpectedly, potentially leading to denial of service. The CVSS score of 8.8 indicates a high impact on confidentiality, integrity, and availability, meaning that the crash could be leveraged to disrupt user sessions or potentially lead to further memory corruption issues. No confirmed active exploitation is reported.

A fix is available in Safari 26.5 and corresponding OS updates (iOS 18.7.9, iPadOS 18.7.9, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5). Users and administrators should update to these versions to remediate the vulnerability. For Red Hat Enterprise Linux 7 Extended Lifecycle Support users, updated WebKitGTK+ packages (e.g., webkitgtk4-2.52.4-1.el7_9) are available and should be applied promptly. Patch status is confirmed by vendor advisories. No additional mitigations are specified by the vendor.