Description
A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may disclose sensitive user information.
Published: 2026-06-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a cross‑origin issue where the browser’s tracking of security origins was insufficient, allowing maliciously crafted web content to disclose sensitive user information. This weakness aligns with CWE-346.

Affected Systems

Affected systems are Apple’s web browser and platform components: Safari, iOS, iPadOS, and macOS Tahoe. The issue is fixed in version 26.5.2 for Safari, iOS, iPadOS, and macOS Tahoe; users running earlier releases are potentially exposed.

Risk and Exploitability

A CVSS score of 6.5 indicates medium severity and no EPSS score or KEV listing suggests that exploitation has not yet been observed or reported in the wild. Based on the description, it is inferred that attackers could entice users to visit malicious websites or fall for social engineering or drive‑by phishing attacks to exploit this cross‑origin information leakage. While no public exploits exist, the potential for sensitive data disclosure warrants prompt patching.

Generated by OpenCVE AI on June 30, 2026 at 02:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Safari, iOS, iPadOS, and macOS to the fixed release 26.5.2 or later.
  • Enable automatic software updates on all Apple devices to receive security patches promptly.
  • Educate users to avoid visiting untrusted websites and to be cautious of social‑engineering attempts that could exploit cross‑origin data leakage.

Generated by OpenCVE AI on June 30, 2026 at 02:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 30 Jun 2026 02:45:00 +0000

Type Values Removed Values Added
Title Cross-origin Information Disclosure in Apple Web Browser and Platforms

Tue, 30 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari

Tue, 30 Jun 2026 01:15:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Information Disclosure in Apple Browsers and Operating Systems
Weaknesses CWE-200

Mon, 29 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-346
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Jun 2026 21:45:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Information Disclosure in Apple Browsers and Operating Systems
Weaknesses CWE-200

Mon, 29 Jun 2026 20:15:00 +0000

Type Values Removed Values Added
Description A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may disclose sensitive user information.
References

Subscriptions

Apple Ios And Ipados Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-06-29T21:36:30.506Z

Reserved: 2026-05-01T22:46:21.643Z

Link: CVE-2026-43700

cve-icon Vulnrichment

Updated: 2026-06-29T21:36:24.108Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-30T02:30:05Z

Weaknesses