Description
A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.
Published: 2026-03-25
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to script message handlers of other origins leading to potential data leakage or misuse
Action: Apply Update
AI Analysis

Impact

A logic flaw in Apple’s WebKit engine allows a malicious website to read or interact with script message handlers that belong to other origins. The vulnerability is a cross‑origin data access issue identified as CWE-346, which can expose internal communication mechanisms and potentially allow an attacker to execute unintended code paths or exfiltrate sensitive information.

Affected Systems

The flaw affects Apple’s browsers and operating systems, including Safari on macOS and visionOS, as well as web views embedded in iOS and iPadOS applications. It is fixed in Safari 26.4, iOS and iPadOS 18.7.7/26.4, macOS Tahoe 26.4 and visionOS 26.4. Versions prior to these releases are potentially vulnerable.

Risk and Exploitability

The CVSS score of 4.3 denotes moderate impact, the EPSS score indicates a very low probability of exploitation (under 1%), and the vulnerability is not listed in CISA’s KEV catalog. Attacks would be performed by a user visiting a compromised site, making exploitation a remote, client‑side event. While the risk is limited, the impact to confidentiality of inter‑origin communication warrants timely remediation.

Generated by OpenCVE AI on April 1, 2026 at 05:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Safari to version 26.4 or later
  • Upgrade iOS and iPadOS to 18.7.7 or 26.4
  • Install macOS update to Tahoe 26.4
  • Apply visionOS update to 26.4
  • Ensure automatic system updates are enabled to receive the latest WebKit patches

Generated by OpenCVE AI on April 1, 2026 at 05:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Apr 2026 02:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Tue, 31 Mar 2026 03:00:00 +0000

Type Values Removed Values Added
Title Cross-Origin Script Message Handler Access in Safari, iOS, macOS, and visionOS webkitgtk: A malicious website may be able to access script message handlers intended for other origins
Weaknesses CWE-346
References
Metrics threat_severity

None

 threat_severity

Important

Sun, 29 Mar 2026 20:45:00 +0000

Type Values Removed Values Added
Title Cross-Origin Script Message Handler Access in Safari, iOS, macOS, and visionOS
Weaknesses CWE-200

Fri, 27 Mar 2026 20:30:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Script Message Handler Exposure in Apple Safari and Related Platforms.
Weaknesses CWE-200

Fri, 27 Mar 2026 09:30:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Script Message Handler Exposure in Apple Safari and Related Platforms.
Weaknesses CWE-200

Thu, 26 Mar 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Thu, 26 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 12:30:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Script Message Handler Access in Safari and Apple Operating Systems
Weaknesses CWE-200

Wed, 25 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Script Message Handler Access in Safari and Apple Operating Systems
Weaknesses CWE-200

Wed, 25 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari
Apple visionos

Wed, 25 Mar 2026 01:00:00 +0000

Type Values Removed Values Added
Description A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari Visionos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:14:58.468Z

Reserved: 2026-03-03T16:36:03.972Z

Link: CVE-2026-28861

cve-icon Vulnrichment

Updated: 2026-03-26T13:48:50.222Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-25T01:17:10.130

Modified: 2026-03-26T16:29:34.313

Link: CVE-2026-28861

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-28T20:00:00Z

Links: CVE-2026-28861 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-02T07:59:17Z

Weaknesses