CVE-2026-28946

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Gia Bui (@yabeow) from Calif.io, dr3dd, w0wbox

Attribute	Value
CVE	CVE-2026-28946
Bugzilla	310544
Component	WebCore
Bug Class	UAF
Severity	medium
Commit	869d5c55313783da…
Advisory	Apple Advisory

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebCore/html/BaseDateAndTimeInputType.cpp
• Source/WebCore/html/BaseDateAndTimeInputType.h
• Source/WebCore/html/shadow/DateTimeEditElement.cpp
• Source/WebCore/html/shadow/DateTimeEditElement.h

Test Files

• LayoutTests/fast/forms/date/date-editable-components/date-editable-components-change-type-on-input-event-expected.txt
• LayoutTests/fast/forms/date/date-editable-components/date-editable-components-change-type-on-input-event.html