Product:
Safari
Summary
A logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4. Visiting a maliciously crafted website may lead to a cross-site scripting attack.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-28871 |
Exploitation
To exploit this vulnerability, an attacker can create a maliciously crafted website that, when visited by a user, may execute a cross-site scripting attack. This requires user interaction, as the user must visit the site for the attack to be successful.
Affected Products
- Safari: Affected by the logic issue that allows cross-site scripting attacks.
- iOS: Versions 18.7.7 and 26.4 are affected.
- iPadOS: Versions 18.7.7 and 26.4 are affected.
- macOS Tahoe: Version 26.4 is affected.
Mitigation
Users are advised to update their Safari and iOS/iPadOS/macOS Tahoe to the latest versions to mitigate the risk of this vulnerability. Keeping software up to date is crucial in protecting against potential exploits.