CVE-2026-28902 is a vulnerability in Apple Safari caused by improper memory handling when processing maliciously crafted web content, leading to an unexpected process crash. The issue affects Safari and related WebKitGTK+ components used in various platforms. The vulnerability is tracked under CWE-119 and CWE-120, indicating issues with improper memory operations. Red Hat has released security updates for webkitgtk4 packages in Red Hat Enterprise Linux 7 Extended Life Cycle Support to address this and other related WebKitGTK+ vulnerabilities. The vulnerability has a CVSS v3.1 base score of 6.5, reflecting a medium severity impact primarily due to denial of service (process crash) without confidentiality or integrity impact. The issue is fixed in Safari 26.5 and corresponding OS versions (iOS, iPadOS, macOS Tahoe, tvOS, visionOS, watchOS).

The vulnerability allows an attacker to cause an unexpected process crash in Safari by delivering specially crafted web content. This results in a denial of service condition (application crash) but does not impact confidentiality or integrity. There are no known exploits in the wild. The crash could disrupt user browsing sessions or dependent applications using the affected WebKitGTK+ component.

A fix is available and has been applied in Safari 26.5 and corresponding OS versions (iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5). Red Hat has also released updated webkitgtk4 packages for Red Hat Enterprise Linux 7 Extended Life Cycle Support to address this vulnerability. Users and administrators should apply these official updates promptly to remediate the issue. Patch status is confirmed by vendor advisories. No additional mitigation actions are specified beyond applying these updates.