Dashboard / CVE-2026-28861

CVE-2026-28861

INFO Priority: 0.00 BB Relevance: 0/100
Published: 2026-03-25 Modified: 2026-10-26 First seen: 2026-10-29 Status: pending_score

Description

A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.

Weakness Classification (2)

Affected Software (5)

VendorProductVersion
apple ipados < 18.7.7
apple iphone_os < 18.7.7
apple macos < 26.4
apple safari < 26.4
apple visionos < 26.4

References & Advisories (8)

https://support.apple.com/en-us/126792
Release Notes Vendor Advisory
https://support.apple.com/en-us/126793
Release Notes Vendor Advisory
https://support.apple.com/en-us/126794
Release Notes Vendor Advisory
https://support.apple.com/en-us/126799
Release Notes Vendor Advisory
https://support.apple.com/en-us/126800
Release Notes Vendor Advisory

Bug Bounty Relevance

0 / 100

CVSS Score

Unscored

EPSS — Exploitation Probability

0.32%
Raw Score 0.003220
Percentile 25.2%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00322
2026-10-28
0.00322

Intelligence Sources

mitre ref →

External Links