Product:
iOS, iPadOS, macOS, tvOS, visionOS, watchOS
Summary
An information leakage was addressed with additional validation. This issue may allow sensitive data to be leaked when visiting a maliciously crafted website. The vulnerability has been fixed in several versions of Apple’s operating systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2026-28920 |
Exploitation
To exploit this vulnerability, an attacker could create a maliciously crafted website that, when visited by a user, could lead to the leakage of sensitive information. The attack requires user interaction, as the user must visit the malicious site for the exploit to be successful.
Affected Products
- iOS 18.7.9 and earlier: Vulnerable to information leakage when visiting malicious websites.
- iPadOS 18.7.9 and earlier: Similar vulnerability as iOS.
- macOS Sequoia 15.7.7 and earlier: Affected by the same information leakage issue.
- macOS Sonoma 14.8.7 and earlier: Vulnerable to data leakage.
- macOS Tahoe 26.5 and earlier: Also affected by this vulnerability.
- tvOS 26.5 and earlier: Vulnerable to information leakage.
- visionOS 26.5 and earlier: Affected by the same issue.
- watchOS 26.5 and earlier: Vulnerable to data leakage.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of iOS, iPadOS, macOS, tvOS, visionOS, and watchOS as soon as possible. Keeping software up to date is crucial in protecting against known vulnerabilities.