CVE-2026-28955 is a vulnerability in Apple Safari and WebKitGTK+ where processing specially crafted web content can lead to an unexpected process crash due to improper memory handling (related to CWE-119 and CWE-120). This vulnerability affects multiple Apple platforms and WebKitGTK+ on Red Hat Enterprise Linux 7 Extended Lifecycle Support. The issue has been fixed in Safari 26.5 and corresponding OS versions, as well as in updated WebKitGTK+ packages provided by Red Hat. The vulnerability has a CVSS v3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Red Hat advisories provide patches for affected WebKitGTK+ packages. There are no known exploits in the wild at this time.

Successful exploitation of this vulnerability may cause Safari or WebKitGTK+ processes to crash unexpectedly, potentially leading to denial of service. The CVSS score of 8.8 indicates a high impact on confidentiality, integrity, and availability, meaning that the vulnerability could be leveraged to disrupt browser functionality and potentially impact user data security. No confirmed active exploitation is reported.

A fix is available and has been released by Apple in Safari 26.5 and related OS versions (iOS 18.7.9, iPadOS 18.7.9, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5). Red Hat has also issued security updates for WebKitGTK+ packages on Red Hat Enterprise Linux 7 Extended Lifecycle Support. Users and administrators should apply these official patches promptly to remediate the vulnerability. Patch status is confirmed by vendor advisories. No additional mitigation steps are indicated by the vendor advisories.