{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28861", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2026-03-03T16:36:03.972Z", "datePublished": "2026-03-25T00:32:03.933Z", "dateUpdated": "2026-03-25T00:32:03.933Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "A malicious website may be able to access script message handlers intended for other origins"}]}], "affected": [{"vendor": "Apple", "product": "Safari", "versions": [{"version": "0", "status": "affected", "lessThan": "26.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.7.7", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "26.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "0", "status": "affected", "lessThan": "26.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"version": "0", "status": "affected", "lessThan": "26.4", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins."}], "references": [{"url": "https://support.apple.com/en-us/126792"}, {"url": "https://support.apple.com/en-us/126793"}, {"url": "https://support.apple.com/en-us/126794"}, {"url": "https://support.apple.com/en-us/126799"}, {"url": "https://support.apple.com/en-us/126800"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-03-25T00:32:03.933Z"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins."}], "id": "CVE-2026-28861", "lastModified": "2026-03-25T15:41:33.977", "metrics": {}, "published": "2026-03-25T01:17:10.130", "references": [{"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/126792"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/126793"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/126794"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/126799"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/126800"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Awaiting Analysis"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,18.7.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "iOS and iPadOS", "source": "cna", "vendor": "Apple"}, "product": "ios_and_ipados", "vendor": "apple"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "macOS", "source": "cna", "vendor": "Apple"}, "product": "macos", "vendor": "apple"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Safari", "source": "cna", "vendor": "Apple"}, "product": "safari", "vendor": "apple"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "visionOS", "source": "cna", "vendor": "Apple"}, "product": "visionos", "vendor": "apple"}], "analysis": {"en": {"generated_at": "2026-03-25T02:46:42.904355+00:00", "value": {"mitigation_remediation": ["Upgrade Safari to version 26.4 or later", "Upgrade iOS to 18.7.7 or 26.4", "Upgrade iPadOS to 18.7.7 or 26.4", "Upgrade macOS (Tahoe) to 26.4", "Upgrade visionOS to 26.4"], "summary": {"action": "Apply Patch", "impact": "Confidentiality Exposure via Cross\u2011Origin Script Message Handler Access"}, "threat_synthesis": {"affected_systems": "Apple Safari, iOS, iPadOS, macOS (Tahoe) and visionOS are affected. The problem is resolved in Safari 26.4, iOS 18.7.7 or 26.4, iPadOS 18.7.7 or 26.4, macOS Tahoe 26.4 and visionOS 26.4.", "description_and_impact": "A logic flaw in the state management of Apple WebKit allows a malicious website to access script message handlers that belong to other origins. The flaw can enable the attacker to read or manipulate data intended for scripts from trusted domains, effectively leaking sensitive information. This vulnerability is a classic information\u2011disclosure weakness, where improper isolation permits cross\u2011origin data access.", "risk_and_exploitability": "The vulnerability can be triggered by visiting a crafted website; no privileged user interaction is required. Although no CVSS or EPSS metrics are available, the ability to read privileged data suggests a moderate to high impact. The lack of a KEV listing indicates that known exploitation is not documented, but the attack surface and the ease of exploitation warrant prompt remediation."}}}}, "created": "2026-03-25T11:36:42.833507+00:00", "title": "Cross\u2011Origin Script Message Handler Access in Safari and Apple Operating Systems", "updated": "2026-03-25T20:56:25.926557+00:00", "vendors": ["apple", "apple$PRODUCT$ios_and_ipados", "apple$PRODUCT$macos", "apple$PRODUCT$safari", "apple$PRODUCT$visionos"], "weaknesses": ["CWE-200"]}