Unrated
Safari, iOS and iPadOS and 2 more products — security advisory
A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.
- Products
- Safari, iOS and iPadOS, macOS, visionOS
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-28861
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 21:39 UTC · Revision 1
Source evidence
A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.
cve:CVE-2026-28861
Safari
Fixed versions: Not specified
iOS and iPadOS
Fixed versions: Not specified
macOS
Fixed versions: Not specified
visionOS
Fixed versions: Not specified
Complete source record
{
"id": "e52300823e4dcd91b0bdb6957471286449f707fac9113d7303eb924dfeea4307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28861",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-28861",
"summary": "A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.",
"evidence": "cve:CVE-2026-28861",
"products": [
{
"name": {
"value": "Safari",
"evidence": "/containers/cna/affected/0/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "iOS and iPadOS",
"evidence": "/containers/cna/affected/1/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "macOS",
"evidence": "/containers/cna/affected/2/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "visionOS",
"evidence": "/containers/cna/affected/3/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-28861",
"aliases": [
"CVE-2026-28861"
],
"metrics": [],
"affected": [
{
"vendor": "Apple",
"product": "Safari",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "26.4",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "iOS and iPadOS",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "18.7.7",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"lessThan": "26.4",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "macOS",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "26.4",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "visionOS",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "26.4",
"versionType": "custom"
}
]
}
],
"modified": "2026-10-26T20:37:12.147Z",
"provider": "cve",
"references": [
"https://support.apple.com/en-us/126792",
"https://support.apple.com/en-us/126793",
"https://support.apple.com/en-us/126794",
"https://support.apple.com/en-us/126799",
"https://support.apple.com/en-us/126800"
],
"provider_metadata": {
"adp": [
{
"title": "CISA ADP Vulnrichment",
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
}
},
{
"other": {
"type": "ssvc",
"content": {
"id": "CVE-2026-28861",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-03-26T13:48:37.064780Z"
}
}
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"type": "CWE",
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
}
]
}
],
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-05-10T13:01:42.660Z"
}
},
{
"title": "webkitgtk: A malicious website may be able to access script message handlers intended for other origins",
"metrics": [
{
"other": {
"type": "Red Hat severity rating",
"content": {
"value": "Important",
"namespace": "https://access.redhat.com/security/updates/classification/"
}
}
},
{
"format": "CVSS",
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
}
}
],
"affected": [
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "webkitgtk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "webkitgtk3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "webkitgtk4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"packageName": "webkit2gtk3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"packageName": "webkit2gtk3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-30T12:37:40.953Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-28T20:00:00.000Z",
"value": "Made public."
}
],
"x_adpType": "supplier",
"datePublic": "2026-03-28T20:00:00.000Z",
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-28861",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453007",
"name": "RHBZ#2453007",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28861.json",
"tags": [
"x_sadp-csaf-vex"
]
}
],
"x_generator": {
"engine": "sadp-cli 1.0.0"
},
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in WebKitGTK. A maliciously crafted web page can cause a logic issue due to improper state management and may be able to access script message handlers intended for other origins."
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"type": "CWE",
"cweId": "CWE-346",
"description": "Origin Validation Error"
}
]
}
],
"providerMetadata": {
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP",
"dateUpdated": "2026-07-15T01:11:20.134Z"
}
}
],
"cna": {
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple",
"dateUpdated": "2026-10-26T20:37:12.147Z"
}
}
},
"related_cves": [
{
"value": "CVE-2026-28861",
"evidence": "/cveMetadata/cveId"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-cve",
"document_id": 344355,
"published_at": "2026-03-25T00:32:03.933+00:00"
}