CVE-2026-28859: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-28859 is a WebKit memory handling vulnerability that allows a malicious website to process restricted web content outside the browser sandbox. It affects Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS — all versions prior to 26.4. The vulnerability was disclosed and patched on March 24, 2026, and was credited to researchers greenbynox, Arni Hardarson, and an anonymous researcher (WebKit Bugzilla: 308248). It carries a CVSS v3.1 base score of 4.3 (Medium) (Apple iOS/iPadOS Advisory, Apple visionOS Advisory).

The root cause is insufficient memory handling within the WebKit browser engine, classified under CWE-125 (Out-of-bounds Read), CWE-416 (Use After Free), and CWE-787 (Out-of-bounds Write). The flaw enables a malicious website to trigger improper memory operations that allow web content to be processed outside the intended sandbox boundary — a container/sandbox escape scenario. Exploitation requires user interaction (visiting a crafted malicious website) and no special privileges or authentication, making it a network-delivered, user-triggered attack. Apple addressed the issue with improved memory handling in WebKit (Apple iOS/iPadOS Advisory, Apple macOS Advisory).

Successful exploitation allows a malicious website to process restricted web content outside the WebKit sandbox, potentially exposing data that sandbox isolation is designed to protect. The primary impact is a confidentiality breach — an unauthenticated remote attacker could access sensitive information from other origins or the host system that should be inaccessible to web content. Integrity and availability are not directly impacted per the CVSS assessment, but sandbox escape can serve as a stepping stone for chaining with other vulnerabilities to achieve broader system compromise (Apple iOS/iPadOS Advisory, Apple visionOS Advisory).

1. Reconnaissance: Identify potential victims using Apple devices running Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, or watchOS versions prior to 26.4.
2. Craft malicious website: Develop a webpage that triggers the WebKit memory mishandling flaw (WebKit Bugzilla: 308248), exploiting out-of-bounds read/write or use-after-free conditions in the WebKit rendering engine.
3. Deliver the payload: Lure the target user to visit the malicious website via phishing emails, malicious ads, or compromised legitimate sites.
4. Trigger sandbox escape: When the victim's browser processes the crafted web content, the memory handling flaw causes restricted content to be processed outside the WebKit sandbox boundary.
5. Access restricted data: With sandbox isolation bypassed, the attacker's web content can potentially read sensitive data from protected memory regions or other origins that should be inaccessible (Apple iOS/iPadOS Advisory, Apple macOS Advisory).

• Network: Unexpected outbound connections from Safari or WebKit-based browser processes to unknown external hosts; unusual HTTP/HTTPS requests to newly registered or low-reputation domains.
• Logs: Browser crash logs or WebKit process termination events coinciding with visits to unfamiliar websites; system logs showing WebKit renderer process anomalies.
• Process: Unusual child processes spawned by the WebKit renderer or Safari process; WebKit content processes accessing file system paths outside expected sandbox directories.
• File System: Unexpected files written by browser processes outside designated sandbox containers on macOS.

Apple has released patches addressing this vulnerability in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4 — all released March 24, 2026. Users and administrators should update all affected Apple devices to these versions immediately. As a temporary workaround prior to patching, users should avoid visiting untrusted or unfamiliar websites, and organizations may consider restricting web browsing to known-trusted sites (Apple iOS/iPadOS Advisory, Apple macOS Advisory, Apple visionOS Advisory).

The vulnerability was part of a broader Apple security update released on March 24, 2026, which addressed over 140 vulnerabilities across Apple platforms. Security media coverage highlighted the scale of the update, with outlets such as 9to5Mac and SecureReading covering the iOS 26.4 security release notes. The CIS also issued an advisory noting multiple vulnerabilities in Apple products that could allow for privilege escalation. No specific high-profile researcher commentary focused exclusively on CVE-2026-28859 has been identified beyond the credited researchers (greenbynox, Arni Hardarson, and an anonymous researcher) (9to5Mac, CIS Advisory).