VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Mar 25, 2026· Updated May 10, 2026

CVE-2026-28861

CVE-2026-28861

Description

A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A logic issue in Safari allowed a malicious website to access script message handlers from other origins, potentially leaking cross-origin data.

Vulnerability

A logic issue in Safari's state management could allow a malicious website to access script message handlers intended for other origins. This cross-origin violation arises from improper handling of script message handler registrations, enabling the attacker to intercept or manipulate messages meant for different web origins.

Exploitation

Exploitation requires no special privileges or user interaction beyond visiting a malicious website. The attacker can craft a web page that sends script messages to handlers registered by legitimate origins, bypassing same-origin restrictions. This affects Safari on various Apple platforms including iOS, iPadOS, macOS, and visionOS.

Impact

An attacker could read or modify messages sent to script message handlers from other origins, potentially leading to data leakage, session hijacking, or unauthorized actions on behalf of the user. The severity is medium (CVSS 4.3) due to the need for user interaction and network access.

Mitigation

The issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4 [1][2][3][4]. Users are advised to update to the latest versions to mitigate the risk.

References
  1. About the security content of iOS 26.4 and iPadOS 26.4 - Apple Support
  2. About the security content of macOS Tahoe 26.4 - Apple Support
  3. About the security content of visionOS 26.4 - Apple Support
  4. About the security content of iOS 18.7.7 and iPadOS 18.7.7 - Apple Support

AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

12
  • Apple Inc./Safari3 versions
    cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*range: <26.4
    • (no CPE)range: <26.4
    • (no CPE)range: 0
  • Apple Inc./Ipados
    cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
    Range: <18.7.7
  • Apple Inc./Iphone Os
    cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
    Range: <18.7.7
  • Apple Inc./macOS2 versions
    cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*range: <26.4
    • (no CPE)range: 0
  • Apple Inc./Visionos2 versions
    cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*range: <26.4
    • (no CPE)range: 0
  • Cisco Systems, Inc./Cisco iOSllm-fuzzy
    Range: <18.7.7
  • Apple Inc./macOS Tahoellm-fuzzy
    Range: <26.4
  • Apple/iOS and iPadOSv5
    Range: 0

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

22