Apple Safari 26.5 Security Update (WebKit/WebRTC Vulnerabilities CVE List)

Safari 26.5 Security Update Summary Vulnerability Overview Apple has released a security update for Safari 26.5, addressing multiple security vulnerabilities in WebKit and WebRTC. These vulnerabilities primarily involve the handling of malicious web content, memory management, input validation, access control, and data protection. Impact Scope Affected Systems: macOS Sonoma and macOS Sequoia Affected Components: WebKit and WebRTC Remediation Apple has fixed the following vulnerabilities by improving logic, input validation, memory management, access control, data protection, and UI handling: WebKit Vulnerabilities 1. CVE-2026-43660 - Impact: Processing malicious web content may prevent Content Security Policy from being enforced - Fix: Improved logic 2. CVE-2026-28907 - Impact: Processing malicious web content may prevent Content Security Policy from being enforced - Fix: Improved input validation 3. CVE-2026-28962 - Impact: Processing malicious web content may disclose sensitive user information - Fix: Improved access control 4. CVE-2026-43658 - Impact: Processing malicious web content may lead to an unexpected crash - Fix: Improved memory management 5. CVE-2026-28905 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 6. CVE-2026-28847 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 7. CVE-2026-28904 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 8. CVE-2026-28955 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 9. CVE-2026-28903 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 10. CVE-2026-28953 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 11. CVE-2026-28902 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 12. CVE-2026-28901 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 13. CVE-2026-28913 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 14. CVE-2026-28883 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 15. CVE-2026-28958 - Impact: An app may be able to access sensitive user data - Fix: Improved data protection 16. CVE-2026-28917 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved input validation 17. CVE-2026-28947 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 18. CVE-2026-28946 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 19. CVE-2026-28942 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management 20. CVE-2026-28971 - Impact: A malicious iframe may use another website's download settings - Fix: Improved UI handling 21. CVE-2026-28944 - Impact: Processing malicious web content may lead to an unexpected process crash - Fix: Improved memory management Additional Acknowledgments Safari: Thanks to sean mutuku for assistance Safari Push Notifications: Thanks to Robert Mindo for assistance WebKit: Thanks to Muhammad Zaid Ghifari, Kallimantan Utara, Qadhafy Muhammad Tera, Vitaly Simonovich for assistance WebRTC: Thanks to Hyeonji Son for assistance Release Date May 13, 2026

Goal Reached Thanks to every supporter — we hit 100%!

Apple Safari 26.5 Security Update (WebKit/WebRTC Vulnerabilities CVE List)