The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Apple
  • Ios And Ipados
  • Ipados
  • Iphone Os
  • Macos
  • Safari
  • Visionos

Configuration 1 [-]

OR cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://www.spirityenterprise.com/managed-detection-response spirity
https://support.apple.com/en-us/126792 cve-icon cve-icon
https://support.apple.com/en-us/126794 cve-icon cve-icon
https://support.apple.com/en-us/126799 cve-icon cve-icon
https://support.apple.com/en-us/126800 cve-icon cve-icon
History

Thu, 26 Mar 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Thu, 26 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CWE-416
CWE-787
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 12:30:00 +0000

Type Values Removed Values Added
Title Safari and Apple OS Crash from Malicious Web Content
Weaknesses CWE-787

Wed, 25 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Title Safari and Apple OS Crash from Malicious Web Content
Weaknesses CWE-787

Wed, 25 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos

Wed, 25 Mar 2026 01:00:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-03-26T14:34:10.558Z

Reserved: 2026-03-03T16:36:03.972Z

Link: CVE-2026-28857

cve-icon Vulnrichment

Updated: 2026-03-26T14:34:07.646Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-25T01:17:09.817

Modified: 2026-03-26T18:25:21.360

Link: CVE-2026-28857

cve-icon Redhat

No data.