CVE-2026-28861A logic issue was addressed with improved state management.
Updated under an hour ago ()
Does this affect you?
It affects apple safari and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.
- CVSS
- 4.3 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- Weakness (CWE)
- CWE-79, CWE-346
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Modified
- Record last updated
- Jul 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
apple safari apple:safari | before 26.4 | NVD |
apple ipados apple:ipados | before 18.7.7; from 26.0 before 26.4 | NVD |
apple iphone_os apple:iphone_os | before 18.7.7; from 26.0 before 26.4 | NVD |
apple macos apple:macos | before 26.4 | NVD |
apple visionos apple:visionos | before 26.4 | NVD |
References
- https://support.apple.com/en-us/126792release-notes, vendor-advisory
- https://support.apple.com/en-us/126793release-notes, vendor-advisory
- https://support.apple.com/en-us/126794release-notes, vendor-advisory
- https://support.apple.com/en-us/126799release-notes, vendor-advisory
- https://support.apple.com/en-us/126800release-notes, vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-28861
- https://bugzilla.redhat.com/show_bug.cgi?id=2453007
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28861.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.