Product:
iOS, iPadOS, macOS, visionOS
Summary
The issue was addressed with improved UI handling. A malicious iframe may use another website’s download settings. This issue is fixed in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and visionOS 26.5.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-28971 |
Exploitation
To exploit this vulnerability, an attacker could create a malicious iframe that manipulates the download settings of another website. This would require user interaction, as the user must visit the malicious site and engage with the iframe. Once the user interacts with the iframe, the attacker could potentially access or manipulate the download settings of the targeted website.
Affected Products
- iOS: Affected by the vulnerability allowing malicious iframes to manipulate download settings.
- iPadOS: Similar vulnerabilities as iOS, allowing for potential exploitation through user interaction.
- macOS Tahoe: Vulnerable to the same iframe manipulation issues as iOS and iPadOS.
- visionOS: Also affected by the vulnerability, requiring user interaction for exploitation.
Mitigation
To mitigate this issue, users should update their devices to the latest versions of iOS, iPadOS, macOS Tahoe, and visionOS. Regularly updating software can help protect against known vulnerabilities. Additionally, users should be cautious when interacting with unknown websites and iframes.