CVE-2026-28861

CWE-3467 documents7 sources
Severity
4.3MEDIUM
EPSS
0.0%
top 89.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Apple IOS AND IpadosApple MacosApple Safari+3 more
Timeline
PublishedMar 25
Latest updateMar 28

Description

A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages10 packages

▶NVDapple/ipados26.0 — 26.4+1
▶CVEListV5apple/ios_and_ipados< 18.7.7+1
▶CVEListV5apple/macos< 26.4
▶NVDapple/macos< 26.4
▶CVEListV5apple/safari< 26.4

🔴Vulnerability Details

3
GHSA
GHSA-mf24-ggcw-q27g: A logic issue was addressed with improved state management↗2026-03-25
▶
OSV
CVE-2026-28861: A logic issue was addressed with improved state management↗2026-03-25
▶
CVEList
CVE-2026-28861: A logic issue was addressed with improved state management↗2026-03-25
▶

📋Vendor Advisories

2
Red Hat
webkitgtk: A malicious website may be able to access script message handlers intended for other origins↗2026-03-28
▶
Debian
CVE-2026-28861: webkit2gtk - A logic issue was addressed with improved state management. This issue is fixed ...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-28861 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶