CVE-2026-28905

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang

Root Cause Analysis

FTL JIT OSR exit had a phantom array unwritten slot bug where an array’s length was not properly updated after arr.map(f) when f returned the same array. This is a JIT compilation bug in FTL’s OSR exit handling where the compiler incorrectly assumed array shape during bailout.

Attack Path

1. Step 1

Attacker crafts JS that calls arr.map(f) where f returns the same array.

2. Step 2

FTL JIT optimizes the map operation with type assumptions.

3. Step 3

OSR exit (bailout) occurs due to unexpected type or deopt.

4. Step 4

FTL fails to update array length correctly during bailout.

5. Step 5

Out-of-bounds access or type confusion leads to memory corruption.

Files Changed

Test Files

• JSTests/stress/ftl-osr-exit-phantom-array-unwritten-slot.js

Patch Preview

diff --git a/JSTests/stress/ftl-osr-exit-phantom-array-unwritten-slot.js b/JSTests/stress/ftl-osr-exit-phantom-array-unwritten-slot.js
new file mode 100644
index 000000000000..a285bbf64df8
--- /dev/null
+++ b/JSTests/stress/ftl-osr-exit-phantom-array-unwritten-slot.js
@@ -0,0 +1,13 @@
+function opt() {
+    const arr = [0,0,0,0,0,0,0];
+    function f() {
+        arr[0];
+        (0)[0];
+        return arr;
+    }
+    const ret = arr.map(f)
+    ret[0] = 1
+}
+for (let i = 0; i < 200; i++) {
+    opt()
+}