Skip to main content

Apple CVE-2026-28871

| EUVDEUVD-2026-15149 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-03-25 apple GHSA-m46v-chmw-rw9m
XSS Apple Red Hat Suse
4.3
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-79
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

Without published CVSS, EPSS, or KEV data, risk assessment must rely on vulnerability characteristics and patch scope. The attack vector is network-based (user visits malicious website) with no special privileges required, indicating broad exploitability. However, the absence of public proof-of-concept code, active exploitation reports, or EPSS scoring suggests this vulnerability was discovered and patched proactively rather than exploited in the wild. The logic-flaw nature (rather than a memory corruption bug) reduces severity compared to typical remote code execution vulnerabilities, though XSS remains high-impact for credential theft and session hijacking. The rapid patch deployment across multiple platforms and versions indicates Apple's assessment of significance. Real-world priority should be moderate-to-high due to Safari's market share and the prevalence of XSS exploitation in targeted attacks, but not critical without evidence of active exploitation.
Exploit ScenarioDerived

An attacker creates a phishing email containing a link to a maliciously crafted website hosted on a domain resembling a legitimate service (e.g., a credential portal or banking site). When a Safari user clicks the link and visits the page, the attacker's embedded JavaScript executes in the user's browser context, harvesting session cookies or prompting the user to re-enter login credentials via a fake form overlay. The user may not notice the XSS attack due to the visual similarity to legitimate content, allowing the attacker to compromise accounts or steal sensitive information without the user's awareness.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 25, 2026

A cross-site scripting (XSS) vulnerability exists in Apple's Safari browser and iOS/iPadOS operating systems due to insufficient input validation in website content handling. An attacker can craft a malicious website that, when visited by a user, executes arbitrary JavaScript in the context of the victim's browser, potentially stealing credentials, session tokens, or performing actions on behalf of the user. Apple has released patches across Safari 26.4, iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, and macOS Tahoe 26.4 to address this logic flaw, though no CVSS score, EPSS data, or KEV status has been publicly disclosed, suggesting this may be a proactive disclosure rather than an actively exploited vulnerability.

RemediationAI

Immediately update Safari to version 26.4 or later, iOS to version 18.7.7 or 26.4 or later, iPadOS to version 18.7.7 or 26.4 or later, and macOS to Tahoe 26.4 or later via Apple's Software Update mechanism. For users unable to patch immediately, disable JavaScript execution in Safari preferences as a temporary mitigation, though this will degrade website functionality. Additionally, users should avoid visiting untrusted or suspicious websites pending patch deployment. Enterprise administrators should leverage Mobile Device Management (MDM) to enforce automatic updates across iOS and iPadOS devices. Refer to the official Apple security advisories at https://support.apple.com/en-us/126792 through 126800 for detailed patch availability and deployment timelines.

Affected VersionsENISA

iOS and iPadOS 0 <18.7.7
macOS 0 <26.4
iOS and iPadOS 0 <26.4
Safari 0 <26.4

Affected Packages

euvd ios_and_ipados fix: 18.7.7, 26.4
euvd macos fix: 26.4
euvd safari fix: 26.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is rooted in a logic issue within Safari's content security and input sanitization mechanisms, affecting the rendering engine used across Apple's ecosystem. Safari (cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*), iOS and iPadOS (cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*), and macOS (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) all share WebKit rendering technology, making them collectively vulnerable. While no specific CWE classification is provided in the advisory, the XSS attack vector indicates a weakness in output encoding or filter bypass logic—typically CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw allows maliciously crafted HTML or JavaScript to bypass Safari's existing XSS protections, suggesting a logic gap rather than a complete absence of controls.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
SUSE MEDIUM
Red Hat 4.3 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch available
Apr 16, 2026 - 05:29 EUVD
18.7.7,26.4
CVE Published
Mar 25, 2026 - 00:31 nvd
MEDIUM 4.3

DescriptionCVE.org

A logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4. Visiting a maliciously crafted website may lead to a cross-site scripting attack.

Executive ViewAI

Why It Matters

Organizations using A logic should be aware of moderate risk from CVE-2026-28871, a cross-site scripting vulnerability rated CVSS 4.3. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Defer
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Low
Technical Impact
Partial

Priority Score

22
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +22
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

Related Vulnerabilities in Apple iOS and iPadOS 26.4 Security Issues

View all 10
CVE-2026-28863 MEDIUM
6.5
CVE-2026-28856 MEDIUM
4.6
CVE-2026-28857 MEDIUM
6.5
CVE-2026-28874 HIGH
7.5
CVE-2026-28875 HIGH
7.5
CVE-2026-28895 MEDIUM
4.6
CVE-2026-28880 MEDIUM
6.5
CVE-2026-28876 HIGH
7.5
CVE-2026-28858 CRITICAL
9.8

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-28871 ADVISORY https://vuldb.com/?id.352966 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1364/ REF https://support.apple.com/en-us/126792 REF https://support.apple.com/en-us/126793 REF https://support.apple.com/en-us/126794 REF https://support.apple.com/en-us/126800

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy