CVE-2026-28984 in iOS
Summary
by MITRE • 08/17/2026
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. Processing maliciously crafted web content may lead to an unexpected Safari crash.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/17/2026
This vulnerability represents a critical flaw within the WebKit rendering engine, which serves as the core component powering Apple's Safari browser on iOS and iPadOS devices. The root cause of this issue lies in improper memory handling during the processing of web content. Specifically, when the browser encounters maliciously crafted HTML, CSS, or JavaScript that triggers specific edge cases in its parsing logic, it fails to correctly manage allocated memory resources. This mismanagement typically manifests as a heap-based buffer overflow or use-after-free condition, where the application attempts to access memory regions that have been deallocated or are outside the bounds of the intended allocation. Such errors disrupt the normal execution flow and stability of the browser process, leading directly to an unexpected crash rather than allowing for graceful error handling or safe termination.
From a technical perspective, this flaw aligns with CWE-120 Buffer Copy without Checking Size of Input and potentially CWE-416 Use After Free, depending on the specific memory state at the time of exploitation. The vulnerability is categorized under ATT&CK technique T1203 Exploitation for Browser Proxy or T1190 Exploit Public-Facing Application if leveraged via a compromised website. An attacker could exploit this weakness by hosting malicious web content designed to trigger the faulty memory handling routine. When an unsuspecting user visits such a site, the browser processes the crafted input and encounters the memory error, resulting in a denial of service through application crash. While modern mobile operating systems include sandboxing mechanisms that may limit the immediate impact on system stability or other applications, the reliability of the browsing experience is severely compromised, and repeated crashes can degrade user trust and productivity.
The operational impact of this vulnerability extends beyond simple inconvenience. For individual users, it results in interrupted web sessions, loss of unsaved data entered into forms, and potential exposure to further attacks if the crash state allows for code execution or information disclosure, although Apple has classified this primarily as a stability issue rather than an arbitrary code execution vector in public disclosures. In enterprise environments where mobile devices are managed through Mobile Device Management solutions, frequent crashes can hinder productivity and increase support ticket volume. Furthermore, attackers may use such instability to facilitate more sophisticated attacks by forcing the browser into unpredictable states that might bypass certain security checks or lead to information leakage if combined with other vulnerabilities.
Apple has addressed this issue in iOS 18.7.10 and iPadOS 18.7.10 through improved memory handling routines within WebKit. The fix likely involves adding rigorous bounds checking, ensuring proper lifecycle management for allocated objects, and validating input data before processing to prevent invalid memory access patterns. To mitigate the risk associated with this vulnerability, users must update their devices to the latest available software version immediately upon availability. For organizations deploying iOS or iPadOS in production environments, it is essential to configure automatic updates or enforce mandatory patching cycles through MDM policies to ensure all endpoints are protected against such browser-based exploits. Additionally, enabling features like Safari’s Intelligent Tracking Prevention and ensuring that third-party extensions do not interfere with memory management can provide additional layers of defense against malicious web content designed to trigger similar flaws in older software versions.