The iOS 26.2 Trap: New WebKit Integer Overflow Discovered with PoC—Is Your iPhone at Risk?

SecurityOnline[.]info reports a critical WebKit vulnerability in iOS 26.2 that could allow an attacker to crash browsers or, if combined with other exploits, execute arbitrary code on latest iOS devices. The flaw lies in a 32-bit integer overflow during memory-bound calculations for ArrayBuffer, TypedArray and WebAssembly operations within JavaScriptCore, potentially allowing an attacker to craft a memory address that bypasses initial checks.

Gigacage, WebKit’s memory protection, currently terminates the WebContent process when an overflow attempts to access memory outside the 16GB partition, preventing immediate code execution but causing a persistent Denial of Service. The report warns that if Gigacage is bypassed or its base address leaked, the vulnerability could enable Relative Memory Corruption and, in a worst case, Remote Code Execution via Vtable Hijacking.

A PoC using a few lines of JavaScript with a DataView buffer and a specific Uint32 value demonstrates the 32-bit wrap-around and the resulting crash; the issue has been confirmed on iOS 26.2 (Build 23C55) on an iPhone 14 Pro Max and may affect all iOS 26.x releases, macOS Sequoia 15.x, and third‑party iOS browsers using WKWebView.