CVE-2026-28901 Apple CVE debrief

Who should care

Organizations and individuals using Apple devices, particularly those listed in the affected products, should be aware of this vulnerability. This includes users of iPhones, iPads, Macs, Apple TVs, Apple Vision devices, and Apple Watches. Given the MEDIUM severity and potential for process crashes, administrators and users of these devices should prioritize applying the available security updates.

Technical summary

CVE-2026-28901 is a vulnerability in Apple devices that could lead to an unexpected process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 4.3, indicating a MEDIUM severity level. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.

Defensive priority

Apply security updates: Prioritize applying the available security updates for affected Apple devices. Monitor for suspicious web content: Be cautious when accessing web content, especially from untrusted sources, as it may be crafted to exploit this vulnerability.

Recommended defensive actions

• Apply the security updates provided by Apple for affected devices.
• Ensure all Apple devices are running the latest software versions.
• Be cautious when accessing web content, especially from untrusted sources.
• Monitor device performance and investigate any unexpected process crashes.
• Consider implementing additional security measures, such as web content filtering and intrusion detection.

Evidence notes

The CVE-2026-28901 vulnerability was publicly disclosed on May 11, 2026, and last modified on June 30, 2026. The vulnerability affects multiple Apple products, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Apple has provided security updates to address this issue, which are available for affected devices. The CVSS score for this vulnerability is 4.3, indicating a MEDIUM severity level.

Official resources