endpoint-software-vulnerabilitywidely-deployed-product-advisory

Safari 26.5 Fixes Web-Content Flaws Including Memory-Handling CVE-2026-28984

Vulnerability Disclosure · 2 sources · Updated 2mo ago · First seen May 13, 2026

Apple addressed multiple Safari and web-content processing vulnerabilities in Safari 26.5 for macOS Sonoma and macOS Sequoia. Malicious web content could potentially bypass Content Security Policy, expose sensitive information or data, crash Safari or related processes, or abuse another website’s download settings through a malicious iframe. Apple remediated the issues through improved validation, access controls, memory and data handling, logic, and user-interface protections.

The fixes include CVE-2026-28984, a Safari memory-handling flaw that can cause a process crash. Apple credited Artem Dinaburg of Trail of Bits through Anthropic’s coordinated vulnerability disclosure program for that finding, while Apple’s advisory did not identify a specific Anthropic model associated with the report. Other Safari 26.5 fixes include CVE-2026-43660, CVE-2026-28907, CVE-2026-28962, CVE-2026-43658, CVE-2026-28905, CVE-2026-28847, CVE-2026-28958, CVE-2026-28917, CVE-2026-28971, and CVE-2026-28944.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · May 13, 2026

Reported Aug 25, 20262mo ago
Apple confirms and fixes Safari CVE-2026-28984
Apple confirmed CVE-2026-28984, a Safari memory-handling flaw that can cause a process crash, and addressed it in Safari 26.5. Apple credited Artem Dinaburg of Trail of Bits for the report through Anthropic's coordinated vulnerability disclosure program, without identifying a specific Anthropic model.
Apple accepts an Anthropic CVD Safari finding - Bugflation
May 13, 20266mo ago
Apple publishes Safari 26.5 security notice and fixes multiple flaws
Apple published a Safari 26.5 security notice covering web-content handling vulnerabilities affecting macOS Sonoma and macOS Sequoia. The fixes addressed flaws that could bypass Content Security Policy, disclose sensitive information, crash Safari or processes, access sensitive data, or abuse download settings.
About the security content of Safari 26.5 - Apple Support

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Safari and WebKit Memory-Handling Denial of Service (CVE-2026-28984)

Affected products

1 linked

Safari

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

BugflationNews · Aug 25, 2026

Apple accepts an Anthropic CVD Safari finding - BugflationOpen source ↗

Apple SupportAdvisories · May 13, 2026

About the security content of Safari 26.5 - Apple SupportOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Safari 26.5 Fixes Web-Content Flaws Including Memory-Handling CVE-2026-28984

How this story unfolded

Apple confirms and fixes Safari CVE-2026-28984

Apple publishes Safari 26.5 security notice and fixes multiple flaws

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Apple Fixes Safari WebKit Flaws and Notification Retention Privacy Bug

Apple Fixes Safari WebKit Flaws and Xcode Root File-Read Vulnerability

Apple fixes Safari WebKit use-after-free and 30+ flaws across iOS, iPadOS, and macOS

Safari 26.5 Fixes Web-Content Flaws Including Memory-Handling CVE-2026-28984

How this story unfolded

Apple confirms and fixes Safari CVE-2026-28984

Apple publishes Safari 26.5 security notice and fixes multiple flaws

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Apple Fixes Safari WebKit Flaws and Notification Retention Privacy Bug

Apple Fixes Safari WebKit Flaws and Xcode Root File-Read Vulnerability

Apple fixes Safari WebKit use-after-free and 30+ flaws across iOS, iPadOS, and macOS