CVE-2026-28942
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A use-after-free vulnerability was addressed with improved memory management in Safari. The issue is fixed in Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.
Risk Assessment
Processing maliciously crafted web content may lead to an unexpected Safari crash, potentially disrupting user operations and enabling further exploitation.
Recommendation
Immediately update Safari and Apple operating systems to the latest versions listed in the description to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Safari
See all- CVE-2017-2389High
An issue was discovered in certain Apple products affecting iOS before 10.3 and Safari before 10.1. The issue involves the 'Safari' component and allows remote attackers to spoof an HTTP authentication sheet or cause a denial of service via a crafted web site.
- CVE-2017-2376High
An issue was discovered in certain Apple products, including iOS before 10.3 and Safari before 10.1, related to the 'Safari' component. It allows remote attackers to spoof the address bar by leveraging text input during the loading of a page.
- CVE-2025-43541Medium
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2023-28205HighActively exploited
A use after free issue in Safari and Apple systems was addressed with improved memory management. The issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution, and Apple is aware of a report that this issue may have been actively exploited.
- CVE-2026-113949Low risk· EPSS 9%
A type confusion issue in Safari and Apple operating systems was addressed with improved state management. Processing maliciously crafted web content may lead to memory corruption.
- CVE-2026-113904Low risk· EPSS 8%
A use-after-free issue in Safari and Apple operating systems was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process crash.
- CVE-2026-113903Low risk· EPSS 9%
A use-after-free issue in Safari and Apple operating systems was addressed with improved memory management. Processing maliciously crafted web content may lead to unexpected memory modification.
- CVE-2026-113901Low risk· EPSS 9%
A use-after-free issue in Safari and Apple operating systems was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process crash.
- CVE-2026-112599Low risk· EPSS 9%
A use-after-free vulnerability in Safari and Apple operating systems was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process crash.
- CVE-2026-86898Medium
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
Original NVD description (English source)
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS