Skip to main content

Visionos CVE-2026-28861

| EUVDEUVD-2026-15135 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-03-25 apple
XSS Apple Visionos Ios And Ipados
4.3
CVSS 3.1 · Vendor: apple
View

Vulnerability Assessment

Weakness
CWE
CWE-79
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

This vulnerability carries moderate to high real-world risk despite the absence of a CVSS score in the available data. The attack vector is network-based (user visits a malicious website), the attack complexity is low (exploit requires only HTML/JavaScript), and no authentication is required. The information disclosure impact is classified as significant since script message handlers often carry sensitive data including session tokens and user identifiers. The lack of a public CVSS score and EPSS rating suggests either pre-disclosure coordination or rapid patching, which limits available exploitation data. However, the fact that Apple issued patches across five distinct advisory pages (126792, 126793, 126794, 126799, 126800) and coordinated fixes across Safari, iOS, iPadOS, macOS, and visionOS indicates Apple's assessment that this represents a critical cross-platform risk. The logic-based nature of the vulnerability (rather than memory corruption) means it is likely reliably exploitable without significant complexity. Given that script messaging is a core iOS/macOS security boundary mechanism, this vulnerability should be treated as a high-priority patch despite the absence of formal CVSS metrics.
Exploit ScenarioDerived

An attacker creates a malicious website and tricks a user into visiting it via social engineering or malicious advertisement. Once the page loads, the attacker's JavaScript exploits the state management flaw in Safari's script message handler routing to intercept WKScriptMessageHandler calls that were intended for a legitimate banking or authentication website. The attacker receives sensitive data such as OAuth tokens, CSRF parameters, or user session identifiers that would normally only be visible to the legitimate origin. With this information, the attacker can then conduct account takeover, session hijacking, or direct fraud. Because the exploit requires only a malicious website and standard browser navigation (no user interaction beyond clicking a link), the practical risk is amplified in scenarios where users visit untrusted sites or click phishing links.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

A logic error in Apple's script message handler implementation allows malicious websites to access script message handlers intended for other origins, resulting in unauthorized cross-origin information disclosure. This vulnerability affects Safari 26.4 and earlier, iOS/iPadOS 18.7.7 and earlier, macOS Tahoe 26.4 and earlier, and visionOS 26.4 and earlier. An attacker can craft a malicious website that exploits improper state management in the message handler routing mechanism to intercept sensitive data intended for legitimate web applications, potentially exposing authentication tokens, user data, or other confidential information passed through script messaging interfaces.

RemediationAI

Immediately upgrade to Safari 26.4 or later, iOS/iPadOS 18.7.7 or later (or iOS/iPadOS 26.4 or later on supported devices), macOS Tahoe 26.4 or later, or visionOS 26.4 or later. These patches address the logic flaw in script message handler state management by improving validation of origin context before routing messages. Users should enable automatic updates in Settings > General > Software Update (iOS/iPadOS) or System Settings > General > Software Update (macOS) to ensure timely patching. Until patches can be applied, restrict web browsing to trusted websites only and disable JavaScript where feasible for non-essential browsing. Organizations managing Safari deployments should use Mobile Device Management (MDM) or enterprise deployment tools to enforce immediate patching across all endpoints. Refer to Apple's official security advisories at https://support.apple.com/en-us/126792 (Safari), https://support.apple.com/en-us/126793 (iOS), https://support.apple.com/en-us/126794 (iPadOS), https://support.apple.com/en-us/126799 (macOS), and https://support.apple.com/en-us/126800 (visionOS) for version-specific guidance.

Affected VersionsENISA

visionOS 0 <26.4
iOS and iPadOS 0 <18.7.7
macOS 0 <26.4
iOS and iPadOS 0 <26.4
Safari 0 <26.4

Affected Packages

euvd ios_and_ipados fix: 18.7.7, 26.4
euvd macos fix: 26.4
euvd safari fix: 26.4
euvd visionos fix: 26.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in Apple's WebKit engine, specifically in the script message handler subsystem that facilitates communication between web content and native application code. Script message handlers (WKScriptMessageHandler) are a documented API for bridging JavaScript in web pages with native Swift or Objective-C code. The root cause is classified as a logic error in state management—meaning the handler routing mechanism fails to properly maintain or validate the origin context when routing incoming messages. Rather than a traditional memory safety issue, this is a design flaw where the handler state does not correctly enforce same-origin policy constraints, allowing a malicious origin to read messages destined for a different origin. The affected CPE strings (cpe:2.3:a:apple:safari, cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:visionos) indicate the vulnerability spans Safari browser and all iOS, iPadOS, macOS, and visionOS platforms that share the common WebKit rendering engine.

Know when Visionos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
SUSE MEDIUM
Red Hat 4.3 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch available
Apr 16, 2026 - 05:29 EUVD
26.4,18.7.7
CVE Published
Mar 25, 2026 - 00:32 nvd
MEDIUM 4.3

DescriptionCVE.org

A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.

Executive ViewAI

Why It Matters

Organizations using A logic should be aware of moderate risk from CVE-2026-28861 rated CVSS 4.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Defer
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Low
Technical Impact
Partial

Priority Score

22
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +22
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

Related Vulnerabilities in macOS Tahoe 26.4 Security Updates

View all 67
CVE-2026-28839 MEDIUM
5.3
CVE-2026-28879 MEDIUM
6.5
CVE-2026-20695 MEDIUM
6.2
CVE-2026-28825 HIGH
7.1
CVE-2026-28844 MEDIUM
6.5
CVE-2026-20665 MEDIUM
6.5
CVE-2026-20668 MEDIUM
5.5
CVE-2026-28835 MEDIUM
6.5
CVE-2026-28841 MEDIUM
6.2
CVE-2026-28864 LOW
3.3
CVE-2026-20694 MEDIUM
5.5
CVE-2026-20607 MEDIUM
4.0
CVE-2026-20632 MEDIUM
5.3
CVE-2026-20637 MEDIUM
6.2
CVE-2026-20651 MEDIUM
6.2
CVE-2026-20686 MEDIUM
5.3
CVE-2026-20687 HIGH
7.1
CVE-2026-20688 CRITICAL
9.3
CVE-2026-20691 MEDIUM
4.3
CVE-2026-20692 MEDIUM
5.3
CVE-2026-20693 MEDIUM
4.9
CVE-2026-20698 HIGH
7.8
CVE-2026-20699 MEDIUM
6.2
CVE-2026-20701 HIGH
7.5
CVE-2026-28816 MEDIUM
4.0
CVE-2026-28818 MEDIUM
5.3
CVE-2026-28820 MEDIUM
5.3
CVE-2026-28821 HIGH
8.4
CVE-2026-28822 MEDIUM
6.2
CVE-2026-28823 MEDIUM
4.9
CVE-2026-28827 CRITICAL
9.3
CVE-2026-28828 MEDIUM
5.3
CVE-2026-28829 MEDIUM
5.5
CVE-2026-28831 MEDIUM
5.5
CVE-2026-28832 HIGH
8.4
CVE-2026-28837 HIGH
7.5
CVE-2026-28842 HIGH
7.5
CVE-2026-28852 MEDIUM
5.5
CVE-2026-28862 MEDIUM
5.3
CVE-2026-28865 HIGH
7.5
CVE-2026-28866 MEDIUM
6.2
CVE-2026-28868 MEDIUM
5.5
CVE-2026-28886 MEDIUM
5.9
CVE-2026-28892 MEDIUM
5.5
CVE-2026-28893 LOW
3.3
CVE-2026-28894 HIGH
7.5
CVE-2025-43534 MEDIUM
6.8
CVE-2026-20690 MEDIUM
6.5
CVE-2026-28824 MEDIUM
5.3
CVE-2026-28833 MEDIUM
6.2
CVE-2026-28834 MEDIUM
5.1
CVE-2026-20633 MEDIUM
5.5
CVE-2026-20631 HIGH
8.8
CVE-2026-28817 HIGH
8.1
CVE-2026-20639 HIGH
7.5
CVE-2026-20664 MEDIUM
4.3
CVE-2026-28859 MEDIUM
4.3
CVE-2026-20684 LOW
3.3
CVE-2026-28838 MEDIUM
5.3
CVE-2026-20657 MEDIUM
6.5
CVE-2026-28826 MEDIUM
4.0
CVE-2026-28877 MEDIUM
5.5
CVE-2026-28878 MEDIUM
6.5
CVE-2026-28882 MEDIUM
4.0
CVE-2026-20622 HIGH
7.5

More in Visionos

View all
CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2025-24201 CRITICAL
10.0 Mar 11

A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2024-44308 HIGH
8.8 Nov 20

Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-6558 HIGH
8.8

Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2024-44309 MEDIUM
6.3 Nov 20

A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
CVE-2025-43200 MEDIUM
4.2 Jun 16

A denial of service vulnerability in This (CVSS 4.2). Risk factors: actively exploited (KEV-listed).
CVE-2025-43359 CRITICAL POC
9.8 Sep 15

A logic issue was addressed with improved state management. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2024-27815 HIGH
7.8 Jun 10

An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/352958 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1364/ REF https://access.redhat.com/security/cve/CVE-2026-28861 REF https://bugzilla.redhat.com/show_bug.cgi?id=2453007 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28861.json REF https://support.apple.com/en-us/126792 REF https://support.apple.com/en-us/126793 REF https://support.apple.com/en-us/126794 REF https://support.apple.com/en-us/126799 REF https://support.apple.com/en-us/126800

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy