This vulnerability (CVE-2026-28883) is a use-after-free flaw in Apple Safari's web content processing, which can lead to an unexpected process crash. It was addressed by improving memory management in Safari 26.5 and corresponding versions of iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. Red Hat has released security updates for webkitgtk4 on Red Hat Enterprise Linux 7 Extended Lifecycle Support to mitigate this issue. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating a high severity vulnerability exploitable remotely without privileges or user interaction, causing high impact on confidentiality due to potential process crashes.

Processing maliciously crafted web content in affected versions of Safari may cause an unexpected process crash, potentially leading to denial of service or disruption of browser functionality. The CVSS score indicates a high impact on confidentiality, though no integrity or availability impacts are reported. There are no known exploits in the wild at this time.

A fix is available in Safari 26.5 and corresponding OS versions (iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5). Users and administrators should update to these versions to remediate the vulnerability. For Red Hat Enterprise Linux 7 Extended Lifecycle Support users, apply the webkitgtk4 security updates as detailed in the Red Hat advisories (e.g., RHSA-2026:27728). Patch status is confirmed by vendor advisories.