CVE-2026-28847 is a memory handling vulnerability in Apple Safari that can lead to an unexpected process crash when processing maliciously crafted web content. This affects Safari and related Apple operating systems including iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. The vulnerability is fixed in Safari 26.5 and OS versions 18.7.9 and 26.5. Red Hat's advisory for webkitgtk4 on Red Hat Enterprise Linux 7 Extended Lifecycle Support also addresses this issue with updated packages. The vulnerability has a CVSS v3.1 base score of 8.8, reflecting high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No exploits in the wild are currently known.

Successful exploitation of this vulnerability may cause Safari or related processes to crash unexpectedly, potentially leading to denial of service. The CVSS score of 8.8 indicates that the impact on confidentiality, integrity, and availability is high. There is no indication from the data that this vulnerability allows code execution or data disclosure beyond the crash. No known exploits in the wild have been reported.

This vulnerability has been fixed by Apple in Safari 26.5 and corresponding OS versions (iOS 18.7.9 and 26.5, iPadOS 18.7.9 and 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5). Users and administrators should apply these official updates to remediate the issue. For Red Hat Enterprise Linux 7 Extended Lifecycle Support users, updated webkitgtk4 packages (e.g., version 2.52.4-1.el7_9) are available and should be applied as per Red Hat advisory RHSA-2026:27728. Patch status is confirmed fixed in these versions. No additional mitigation actions are indicated by the vendor advisories.