Product:
iOS
Summary
The issue was addressed with improved input validation. Processing maliciously crafted web content may prevent Content Security Policy from being enforced. This vulnerability affects multiple Apple operating systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.1 | CVE-2026-28907 |
Exploitation
An attacker can exploit this vulnerability by crafting malicious web content that, when processed by the affected systems, bypasses the Content Security Policy. This requires user interaction, as the user must visit a specially crafted website to trigger the vulnerability.
Affected Products
- iOS 18.7.9 – Affected by input validation issues that may allow malicious web content to bypass security policies.
- iPadOS 18.7.9 – Similar vulnerabilities as iOS, affecting web content processing.
- macOS Tahoe 26.5 – Vulnerable to the same input validation issues.
- tvOS 26.5 – Affected by the same web content processing vulnerabilities.
- visionOS 26.5 – Vulnerable to the same issues as other Apple operating systems.
- watchOS 26.5 – Also affected by the input validation vulnerabilities.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of the affected operating systems. Apple has released updates that address the input validation issues and enhance security against potential exploits.