medium4.3
CVE-2026-28871
A logic issue was addressed with improved checks.
Impact
A logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4. Visiting a maliciously crafted website may lead to a cross-site scripting attack.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Safari | before 26.4 |
| Apple | Ipados | before 18.7.7 from 26.0 before 26.4 |
| Apple | Iphone Os | before 18.7.7 from 26.0 before 26.4 |
| Apple | Macos | before 26.4 |