CVE-2026-28871

CWE-79 — Cross-site Scripting (XSS)8 documents8 sources
Severity
4.3MEDIUM
EPSS
0.0%
top 89.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Apple IOS AND IpadosApple MacosApple Safari+2 more
Timeline
PublishedMar 25
Latest updateMar 30

Description

A logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4. Visiting a maliciously crafted website may lead to a cross-site scripting attack.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages8 packages

▶NVDapple/ipados26.0 — 26.4+1
▶CVEListV5apple/ios_and_ipados< 18.7.7+1
▶CVEListV5apple/macos< 26.4
▶NVDapple/macos< 26.4
▶CVEListV5apple/safari< 26.4

🔴Vulnerability Details

3
GHSA
GHSA-m46v-chmw-rw9m: A logic issue was addressed with improved checks↗2026-03-25
▶
OSV
CVE-2026-28871: A logic issue was addressed with improved checks↗2026-03-25
▶
CVEList
CVE-2026-28871: A logic issue was addressed with improved checks↗2026-03-25
▶

📋Vendor Advisories

2
Red Hat
webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack↗2026-03-28
▶
Debian
CVE-2026-28871: webkit2gtk - A logic issue was addressed with improved checks. This issue is fixed in Safari ...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-28871 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

1
Bugzilla
CVE-2026-28871 webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack [fedora-all]↗2026-03-30
▶
CVE-2026-28871 (MEDIUM CVSS 4.3) | A logic issue was addressed with im | cvebase.io