Loading vulnerability…
WebKit Memory-Handling Denial of Service
CVE-2026-28857 is a memory-handling vulnerability in WebKit that can cause an unexpected process crash when maliciously crafted web content is processed. It affects Apple products incorporating vulnerable WebKit versions, as well as WebKitGTK and WPE WebKit before 2.52.1. The specific vulnerable function and memory-error subtype are not identified. The issue was addressed through improved memory handling.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash the process handling malicious web content, disrupting browsing or application functionality and causing a process-level denial of service. Arbitrary code execution, information disclosure, and sandbox escape are not established impacts of this vulnerability.
If you can’t patch tonight, do this now.
Until updates can be applied, reduce exposure to untrusted web content and avoid processing web pages from untrusted sources in affected WebKit-based applications.
Patch, then assume compromise.
Update affected Apple installations to Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, or visionOS 26.4, or later supported releases. Safari 26.4 provides the fix for macOS Sonoma and macOS Sequoia. Update WebKitGTK and WPE WebKit to version 2.52.1 or later. For affected Linux distribution packages, install the applicable vendor security updates, including those covered by TuxCare advisory CLSA-2026-1782808694.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.