Loading vulnerability…
WebKit sandbox bypass through improper memory handling
CVE-2026-28859 is a memory-handling vulnerability in WebKit that may allow a malicious website to process restricted web content outside the sandbox. It affects Apple products incorporating vulnerable WebKit versions, as well as WebKitGTK and WPE WebKit before 2.52.1. The vulnerable function and precise memory-safety defect have not been disclosed. The issue was addressed through improved memory handling.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may bypass WebKit sandbox restrictions by allowing restricted web content to be processed outside the sandbox. The specific resources accessible and any resulting code-execution capabilities have not been established.
If you can’t patch tonight, do this now.
Until updates can be applied, reduce exposure to untrusted websites and restrict use of affected WebKit-based browsers or embedded web views where operationally feasible. No product-specific workaround is available in the supplied information.
Patch, then assume compromise.
Update to Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, or watchOS 26.4, as applicable, or a later supported release. Safari 26.4 provides the fix for macOS Sonoma and macOS Sequoia. Update WebKitGTK and WPE WebKit to 2.52.1 or later. For distribution-managed installations, install the vendor-provided security updates for affected WebKit packages.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.