CVE-2026-28905 describes a vulnerability in Apple Safari and WebKitGTK+ where processing maliciously crafted web content can lead to an unexpected process crash due to improper memory handling (CWE-119, CWE-120). The issue affects Safari versions before 26.5 and related OS versions (iOS, iPadOS, macOS Tahoe, tvOS, visionOS). Red Hat has released security updates for WebKitGTK+ on Red Hat Enterprise Linux 7 Extended Lifecycle Support to address this and related vulnerabilities. The vulnerability has a CVSS v3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact but no integrity or availability impact.

Successful exploitation of this vulnerability may cause an unexpected crash of the Safari process or WebKitGTK+ rendering process when processing maliciously crafted web content. This can lead to denial of service for the user browsing affected versions of Safari or applications using WebKitGTK+. The confidentiality impact is rated high in the CVSS vector, but integrity and availability impacts are not indicated. There are no known exploits in the wild at this time.

A fix is available in Safari 26.5 and corresponding OS releases (iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5). Users and administrators should update to these versions to remediate the vulnerability. For Red Hat Enterprise Linux 7 Extended Lifecycle Support users, updated WebKitGTK+ packages (e.g., webkitgtk4-2.52.4-1.el7_9) have been released to address this issue. Applying these vendor-provided updates is the recommended mitigation. Patch status is confirmed by vendor advisories. No additional mitigations are specified or required.