Product:
Safari
Summary
A logic issue was addressed with improved state management. This issue allows a malicious website to potentially access script message handlers intended for other origins. The issue has been fixed in several versions of Safari and related operating systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-28861 |
Exploitation
To exploit this vulnerability, an attacker could create a malicious website that tricks users into visiting it. Once the user interacts with the site, the attacker may gain access to sensitive script message handlers that should be restricted to other origins, leading to potential data leakage or unauthorized actions.
Affected Products
- Safari 26.4: The latest version with improved state management to address the logic issue.
- iOS 18.7.7: The mobile operating system version that includes the fix.
- iPadOS 18.7.7: The iPad version that has been updated to mitigate the vulnerability.
- macOS Tahoe 26.4: The desktop operating system version that resolves the issue.
- visionOS 26.4: The operating system for vision devices that has been patched.
Mitigation
Users are advised to update their Safari browser and related operating systems to the latest versions to mitigate this vulnerability. Regularly checking for updates and applying them promptly can help protect against potential exploits.