Medium severity4.3NVD Advisory· Published Mar 25, 2026· Updated Jul 15, 2026

CVE-2026-28859

Description

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A malicious website may be able to process restricted web content outside the sandbox.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apple Inc./Safari3 versions
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*range: <26.4
- (no CPE)range: = 26.4
- (no CPE)range: 0
Apple Inc./Ipados
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Range: <26.4
Apple Inc./Iphone OS
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Range: <26.4
Apple Inc./macOS2 versions
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*range: <26.4
- (no CPE)range: 0
Apple Inc./tvOS2 versions
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*range: <26.4
- (no CPE)range: 0
Apple Inc./Visionos2 versions
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*range: <26.4
- (no CPE)range: 0
Apple Inc./watchOS2 versions
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*range: <26.4
- (no CPE)range: 0
Apple Inc./iOSllm-fuzzy
Range: = 26.4
osv-coords24 versions
pkg:rpm/almalinux/webkit2gtk3 pkg:rpm/almalinux/webkit2gtk3-devel pkg:rpm/almalinux/webkit2gtk3-jsc pkg:rpm/almalinux/webkit2gtk3-jsc-devel pkg:rpm/opensuse/webkit2gtk3&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/webkit2gtk3&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/webkit2gtk3-soup2&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/webkit2gtk3-soup2&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/webkit2gtk4&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/webkit2gtk4&distro=openSUSE%20Leap%2016.0 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/webkit2gtk3-soup2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7 pkg:rpm/suse/webkit2gtk3-soup2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/webkit2gtk3-soup2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/webkit2gtk4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7 pkg:rpm/suse/webkit2gtk4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7 pkg:rpm/suse/webkit2gtk4&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/webkit2gtk4&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/webkit2gtk4&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/webkit2gtk4&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 2.52.3-1.el8_10+ 23 more
- (no CPE)range: < 2.52.3-1.el8_10
- (no CPE)range: < 2.52.3-1.el8_10
- (no CPE)range: < 2.52.3-1.el8_10
- (no CPE)range: < 2.52.3-1.el8_10
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-160000.1.1
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-160000.1.1
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-160000.1.1
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-160000.1.1
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-160000.1.1
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-160000.1.1
- (no CPE)range: < 2.52.1-150600.12.63.1
- (no CPE)range: < 2.52.1-160000.1.1
Apple Inc./iOS and iPadOScpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

support.apple.com/en-us/126792nvdRelease NotesVendor Advisory
support.apple.com/en-us/126794nvdRelease NotesVendor Advisory
support.apple.com/en-us/126797nvdRelease NotesVendor Advisory
support.apple.com/en-us/126798nvdRelease NotesVendor Advisory
support.apple.com/en-us/126799nvdRelease NotesVendor Advisory
support.apple.com/en-us/126800nvdRelease NotesVendor Advisory
access.redhat.com/errata/RHSA-2026:10702nvd
access.redhat.com/errata/RHSA-2026:11329nvd
access.redhat.com/errata/RHSA-2026:11814nvd
access.redhat.com/errata/RHSA-2026:13845nvd
access.redhat.com/errata/RHSA-2026:14659nvd
access.redhat.com/errata/RHSA-2026:16056nvd
access.redhat.com/errata/RHSA-2026:16695nvd
access.redhat.com/errata/RHSA-2026:19206nvd
access.redhat.com/errata/RHSA-2026:19535nvd
access.redhat.com/errata/RHSA-2026:22136nvd
access.redhat.com/errata/RHSA-2026:9692nvd
access.redhat.com/security/cve/CVE-2026-28859nvd
bugzilla.redhat.com/show_bug.cginvd
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28859.jsonnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000