CVE-2026-28861 - Vulnerability Details - OpenCVE

A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00018.

Key SSVC decision points have not yet been added.

Vendors	Products
Apple	Ios And Ipados Macos Safari Visionos

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Apple	Ios And Ipados Macos Safari Visionos

References

Link	Providers
https://support.apple.com/en-us/126792
https://support.apple.com/en-us/126793
https://support.apple.com/en-us/126794
https://support.apple.com/en-us/126799
https://support.apple.com/en-us/126800

History

Wed, 25 Mar 2026 22:00:00 +0000

Type	Values Removed	Values Added
Title		Cross‑Origin Script Message Handler Access in Safari and Apple Operating Systems
Weaknesses		CWE-200

Wed, 25 Mar 2026 12:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple safari Apple visionos
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple safari Apple visionos

Wed, 25 Mar 2026 01:00:00 +0000

Type	Values Removed	Values Added
Description		A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.
References		https://support.apple.com/en-us/126792 https://support.apple.com/en-us/126793 https://support.apple.com/en-us/126794 https://support.apple.com/en-us/126799 https://support.apple.com/en-us/126800

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-03-25T00:32:03.933Z

Updated: 2026-03-25T00:32:03.933Z

Reserved: 2026-03-03T16:36:03.972Z

Link: CVE-2026-28861

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-03-25T01:17:10.130

Modified: 2026-03-25T15:41:33.977

Link: CVE-2026-28861

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-03-25T20:56:25Z

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,18.7.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "iOS and iPadOS", "source": "cna", "vendor": "Apple"}, "product": "ios_and_ipados", "vendor": "apple"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "macOS", "source": "cna", "vendor": "Apple"}, "product": "macos", "vendor": "apple"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Safari", "source": "cna", "vendor": "Apple"}, "product": "safari", "vendor": "apple"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "visionOS", "source": "cna", "vendor": "Apple"}, "product": "visionos", "vendor": "apple"}], "analysis": {"en": {"generated_at": "2026-03-25T02:46:42.904355+00:00", "value": {"mitigation_remediation": ["Upgrade Safari to version 26.4 or later", "Upgrade iOS to 18.7.7 or 26.4", "Upgrade iPadOS to 18.7.7 or 26.4", "Upgrade macOS (Tahoe) to 26.4", "Upgrade visionOS to 26.4"], "summary": {"action": "Apply Patch", "impact": "Confidentiality Exposure via Cross\u2011Origin Script Message Handler Access"}, "threat_synthesis": {"affected_systems": "Apple Safari, iOS, iPadOS, macOS (Tahoe) and visionOS are affected. The problem is resolved in Safari 26.4, iOS 18.7.7 or 26.4, iPadOS 18.7.7 or 26.4, macOS Tahoe 26.4 and visionOS 26.4.", "description_and_impact": "A logic flaw in the state management of Apple WebKit allows a malicious website to access script message handlers that belong to other origins. The flaw can enable the attacker to read or manipulate data intended for scripts from trusted domains, effectively leaking sensitive information. This vulnerability is a classic information\u2011disclosure weakness, where improper isolation permits cross\u2011origin data access.", "risk_and_exploitability": "The vulnerability can be triggered by visiting a crafted website; no privileged user interaction is required. Although no CVSS or EPSS metrics are available, the ability to read privileged data suggests a moderate to high impact. The lack of a KEV listing indicates that known exploitation is not documented, but the attack surface and the ease of exploitation warrant prompt remediation."}}}}, "created": "2026-03-25T11:36:42.833507+00:00", "title": "Cross\u2011Origin Script Message Handler Access in Safari and Apple Operating Systems", "updated": "2026-03-25T20:56:25.926557+00:00", "vendors": ["apple", "apple$PRODUCT$ios_and_ipados", "apple$PRODUCT$macos", "apple$PRODUCT$safari", "apple$PRODUCT$visionos"], "weaknesses": ["CWE-200"]}