Apple WebKit CVE-2026-28907

Exploitation requires the victim to load attacker-controlled or attacker-influenced web content in a WebKit-backed browser or WebView on an unpatched Apple OS (iOS/iPadOS before 18.7.9 or 26.5, macOS Tahoe before 26.5, tvOS/visionOS/watchOS before 26.5), and per CVSS UI:R the user must actively visit or interact with the malicious page (e.g., click a link, open an HTML email rendered by WebKit). The target site or attack chain must rely on Content Security Policy as a defense - the bug bypasses CSP rather than directly executing code, so practical impact is gated on there being an injectable script vector (e.g., a reflected/stored XSS sink) that CSP would otherwise have blocked. No authentication is required of the attacker (PR:N), and the flaw is reachable over the network (AV:N) with low attack complexity (AC:L); limiting factors are the user-interaction requirement and the need to chain the bypass with an additional script-injection primitive to achieve meaningful impact.

Signals are mixed and warrant a measured-but-prompt response. CVSS 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) indicates remote, low-complexity, unauthenticated exploitation with user interaction yielding high confidentiality and integrity impact, consistent with a browser-rendered exploit. However, CISA SSVC reports Exploitation: none and Automatable: no, EPSS is 0.03% (10th percentile), and there is no KEV listing - so no public exploit is identified at time of analysis. The CVSS C:H/I:H rating is somewhat aggressive for a CSP-bypass-only flaw (which typically enables a downstream attack rather than directly disclosing data) and likely reflects the bypass acting as a force-multiplier when chained with another web vulnerability. The realistic priority is moderate: a defense-in-depth control is broken across Apple's entire ecosystem, but standalone exploitation impact depends on chaining with another web-side weakness.

An attacker hosts a malicious page (or compromises a legitimate site via stored XSS) containing specifically crafted markup that the WebKit parser mishandles, so the page's Content Security Policy is silently not enforced. When a victim using an unpatched Apple device visits the page (the required user interaction), attacker-injected JavaScript that CSP would normally block executes, enabling session token theft, credential harvesting, or pivoting into authenticated web sessions. No public exploit is identified at time of analysis.