This vulnerability (CVE-2026-28953) involves a memory handling flaw in Apple Safari's web content processing that can lead to an unexpected process crash when handling maliciously crafted web content. The issue is fixed in Safari 26.5 and corresponding OS versions including iOS 18.7.9, iPadOS 18.7.9, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Red Hat's advisories confirm patches for WebKitGTK+ packages in Red Hat Enterprise Linux 7 Extended Lifecycle Support addressing this and multiple related CVEs. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact limited to causing a crash (denial of service).

Successful exploitation of this vulnerability may cause Safari or applications using the affected WebKitGTK+ engine to crash unexpectedly, resulting in denial of service. There is no indication of code execution or data integrity impact. Confidentiality impact is rated high in the CVSS vector, but the description and vendor advisories focus on process crashes. No known exploits in the wild have been reported.

A fix is available and has been released in Safari 26.5 and corresponding OS updates (iOS 18.7.9, iPadOS 18.7.9, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5). Users and administrators should apply these updates promptly. For Red Hat Enterprise Linux 7 Extended Lifecycle Support users, updated WebKitGTK+ packages are available and should be applied as per Red Hat advisories. Patch status is confirmed by vendor advisories. No additional mitigation steps are indicated beyond applying the official patches.