CVE-2026-28871

Received Received - Intake

Cross-Site Scripting in Safari and iOS via Malicious Websites

Publication date: 2026-03-25

Last updated on: 2026-03-30

Assigner: Apple Inc.

Description

A logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4. Visiting a maliciously crafted website may lead to a cross-site scripting attack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-25

Last Modified

2026-03-30

Generated

2026-07-06

AI Q&A

2026-03-25

EPSS Evaluated

2026-07-04

NVD

CVE-2026-28871

EUVD

EUVD-2026-15149

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 18.7.7 (exc)
apple	ipados	From 26.0 (inc) to 26.4 (exc)
apple	iphone_os	to 18.7.7 (exc)
apple	iphone_os	From 26.0 (inc) to 26.4 (exc)
apple	macos	to 26.4 (exc)
apple	safari	to 26.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a logic issue in Apple products such as Safari, iOS, iPadOS, and macOS Tahoe. It was addressed by implementing improved checks. The issue could be exploited by visiting a maliciously crafted website, which may lead to a cross-site scripting (XSS) attack.

Impact Analysis

If exploited, this vulnerability can lead to a cross-site scripting attack. This means that an attacker could execute malicious scripts in the context of your browser or device by tricking you into visiting a specially crafted website. This could result in unauthorized actions, data theft, or other malicious activities.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, update affected Apple products to the fixed versions: Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, or macOS Tahoe 26.4.

Hi! I’m here to help you understand CVE-2026-28871. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70