Description
A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may disclose sensitive user information.
Published: 2026-06-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a cross-origin issue arising from insufficient tracking of security origins. An attacker can craft malicious web content that triggers the browser to disclose sensitive user information across origins, which aligns with CWE‑346.

Affected Systems

Affected systems are Apple’s web browser and platform components: Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. The issue is fixed in version 26.5.2 for Safari, iOS, iPadOS, and macOS Tahoe, and in version 26.6 for tvOS, visionOS, and watchOS; users running earlier releases are potentially exposed.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity. The EPSS score of <1% shows that exploitation is expected to be very low, and the vulnerability is not listed in CISA’s KEV catalog. Therefore, no widespread exploitation has been observed. The weakness, rooted in improper origin tracking (CWE‑346), could allow an attacker to cause the browser to reveal private data from a web page that belongs to a different origin, potentially bypassing same-origin policies.

Generated by OpenCVE AI on August 3, 2026 at 06:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update all Apple platforms to the latest security release (Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, watchOS).
  • Enable automatic software updates on all Apple devices to receive security patches promptly.
  • Educate users to avoid visiting untrusted websites and remain vigilant against social‑engineering attempts that could exploit cross-origin data leakage.

Generated by OpenCVE AI on August 3, 2026 at 06:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Title Cross-Origin Data Leakage via Improper Security Origin Tracking in Apple Web Browsers

Fri, 31 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Title Cross-origin Information Disclosure in Apple Web Browser and Platforms

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may disclose sensitive user information. A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may disclose sensitive user information.
References

Tue, 30 Jun 2026 02:45:00 +0000

Type Values Removed Values Added
Title Cross-origin Information Disclosure in Apple Web Browser and Platforms

Tue, 30 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari

Tue, 30 Jun 2026 01:15:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Information Disclosure in Apple Browsers and Operating Systems
Weaknesses CWE-200

Mon, 29 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-346
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Jun 2026 21:45:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Information Disclosure in Apple Browsers and Operating Systems
Weaknesses CWE-200

Mon, 29 Jun 2026 20:15:00 +0000

Type Values Removed Values Added
Description A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may disclose sensitive user information.
References

Subscriptions

Apple Ios And Ipados Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-07-27T20:15:04.068Z

Reserved: 2026-05-01T22:46:21.643Z

Link: CVE-2026-43700

cve-icon Vulnrichment

Updated: 2026-06-29T21:36:24.108Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T07:00:05Z

Weaknesses