{"id":441055,"date":"2026-05-14T09:11:08","date_gmt":"2026-05-14T09:11:08","guid":{"rendered":"https:\/\/www.newsbeep.com\/il\/441055\/"},"modified":"2026-05-14T09:11:08","modified_gmt":"2026-05-14T09:11:08","slug":"safari-26-5-fixes-webkit-bugs-that-could-crash-safari-or-expose-user-data","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/il\/441055\/","title":{"rendered":"Safari 26.5 fixes WebKit bugs that could crash Safari or expose user data"},"content":{"rendered":"

Apple has published the full list of security fixes for Safari 26.5, including a WebKit vulnerability that could let maliciously crafted web content disclose sensitive user information. Here are the details.<\/p>\n

On that same day, the company released the full security content for each update, and you can find more details about it here<\/a>.<\/p>\n

Now, Apple has released the security content for Safari 26.5, which includes fixes for 20 WebKit vulnerabilities, as well as a WebRTC issue that could cause an unexpected process crash.<\/p>\n

WebKit<\/p>\n

Available for: macOS Sonoma and macOS Sequoia<\/p>\n

Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced<\/p>\n

Description: A validation issue was addressed with improved logic.<\/p>\n

WebKit Bugzilla: 308906<\/p>\n

CVE-2026-43660: Cantina<\/p>\n

WebKit<\/p>\n

Available for: macOS Sonoma and macOS Sequoia<\/p>\n

Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced<\/p>\n

Description: The issue was addressed with improved input validation.<\/p>\n

WebKit Bugzilla: 308675<\/p>\n

CVE-2026-28907: Cantina<\/p>\n

WebKit<\/p>\n

Available for: macOS Sonoma and macOS Sequoia<\/p>\n

Impact: Processing maliciously crafted web content may disclose sensitive user information<\/p>\n

Description: This issue was addressed with improved access restrictions.<\/p>\n

WebKit Bugzilla: 309698<\/p>\n

CVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong \/ kakaogames, Vitaly Simonovich, Adel Bouachraoui, greenbynox<\/p>\n

WebKit<\/p>\n

Available for: macOS Sonoma and macOS Sequoia<\/p>\n

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash<\/p>\n

Description: The issue was addressed with improved memory handling.<\/p>\n

WebKit Bugzilla: 307669<\/p>\n

CVE-2026-43658: Do Young Park<\/p>\n

WebKit<\/p>\n

Available for: macOS Sonoma and macOS Sequoia<\/p>\n

Impact: Processing maliciously crafted web content may lead to an unexpected process crash<\/p>\n

Description: The issue was addressed with improved memory handling.<\/p>\n

WebKit Bugzilla: 308545<\/p>\n

CVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang<\/p>\n

WebKit Bugzilla: 308707<\/p>\n

CVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI Zero Day Initiative, Daniel Rhea<\/p>\n

WebKit Bugzilla: 309601<\/p>\n

CVE-2026-28904: Luka Ra\u010dki<\/p>\n

WebKit Bugzilla: 310880<\/p>\n

CVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day Initiative<\/p>\n

WebKit Bugzilla: 310303<\/p>\n

CVE-2026-28903: Mateusz Krzywicki (iVerify.io)<\/p>\n

WebKit Bugzilla: 309628<\/p>\n

CVE-2026-28953: Maher Azzouzi<\/p>\n

WebKit Bugzilla: 309861<\/p>\n

CVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security, Nathaniel Oh (@calysteon)<\/p>\n

WebKit Bugzilla: 310207<\/p>\n

CVE-2026-28901: Aisle offensive security research team (Joshua Rogers, Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi, Ngan Nguyen of Calif.io<\/p>\n

WebKit Bugzilla: 311631<\/p>\n

CVE-2026-28913: an anonymous researcher<\/p>\n

WebKit<\/p>\n

Available for: macOS Sonoma and macOS Sequoia<\/p>\n

Impact: Processing maliciously crafted web content may lead to an unexpected process crash<\/p>\n

Description: A use-after-free issue was addressed with improved memory management.<\/p>\n

WebKit Bugzilla: 313939<\/p>\n

CVE-2026-28883: kwak kiyong \/ kakaogames<\/p>\n

WebKit<\/p>\n

Available for: macOS Sonoma and macOS Sequoia<\/p>\n

Impact: An app may be able to access sensitive user data<\/p>\n

Description: This issue was addressed with improved data protection.<\/p>\n

WebKit Bugzilla: 311228<\/p>\n

CVE-2026-28958: Cantina<\/p>\n

WebKit<\/p>\n

Available for: macOS Sonoma and macOS Sequoia<\/p>\n

Impact: Processing maliciously crafted web content may lead to an unexpected process crash<\/p>\n

Description: The issue was addressed with improved input validation.<\/p>\n

WebKit Bugzilla: 310527<\/p>\n

CVE-2026-28917: Vitaly Simonovich<\/p>\n

WebKit<\/p>\n

Available for: macOS Sonoma and macOS Sequoia<\/p>\n

Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash<\/p>\n

Description: A use-after-free issue was addressed with improved memory management.<\/p>\n

WebKit Bugzilla: 310234<\/p>\n

CVE-2026-28947: dr3dd<\/p>\n

WebKit Bugzilla: 310544<\/p>\n

CVE-2026-28946: Gia Bui (@yabeow) from Calif.io, dr3dd, w0wbox<\/p>\n

WebKit Bugzilla: 312180<\/p>\n

CVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic<\/p>\n

WebKit<\/p>\n

Available for: macOS Sonoma and macOS Sequoia<\/p>\n

Impact: A malicious iframe may use another website\u2019s download settings<\/p>\n

Description: The issue was addressed with improved UI handling.<\/p>\n

CVE-2026-28971: Khiem Tran<\/p>\n

WebKit Bugzilla: 311288<\/p>\n

WebRTC<\/p>\n

Available for: macOS Sonoma and macOS Sequoia<\/p>\n

Impact: Processing maliciously crafted web content may lead to an unexpected process crash<\/p>\n

Description: The issue was addressed with improved memory handling.<\/p>\n

WebKit Bugzilla: 311131<\/p>\n

CVE-2026-28944: Kenneth Hsu of Palo Alto Networks, J\u00e9r\u00f4me DJOUDER, dr3dd<\/p>\n

If your Mac is compatible with Safari 26.5, it might be a good idea to make sure you\u2019re running the latest version as soon as possible.<\/p>\n","protected":false},"excerpt":{"rendered":"Apple has published the full list of security fixes for Safari 26.5, including a WebKit vulnerability that could…\n","protected":false},"author":2,"featured_media":441056,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[85,46,321,125],"class_list":["post-441055","post","type-post","status-publish","format-standard","has-post-thumbnail","category-mobile","tag-il","tag-israel","tag-mobile","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/441055","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/comments?post=441055"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/441055\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media\/441056"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media?parent=441055"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/categories?post=441055"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/tags?post=441055"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}