Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS CVE-2026-28920

Exploitation requires a user on an unpatched Apple device to visit an attacker-controlled website or click a malicious link; the vulnerability does not trigger via passive network access or without user interaction. The vulnerability affects all default browser configurations on affected platforms, meaning standard out-of-the-box Apple devices are susceptible. No special system configuration, non-standard feature enablement, or elevated privileges are required for the malicious website to trigger the information leakage. Users must actively navigate to the attacker's website, either through direct URL access, clicking a link in email or messaging, or social engineering, limiting exploitation to targeted attacks or broad phishing campaigns. Exploitation is limited to information disclosure (confidentiality impact); the vulnerability does not enable code execution, system modification, or denial of service.

The CVSS score of 6.5 reflects a medium-severity confidentiality breach with network attack vector and low attack complexity, but the extremely low EPSS score of 0.03 percent (10th percentile) strongly suggests minimal real-world exploitation despite theoretical exploitability. This significant gap between CVSS and EPSS indicates the vulnerability requires specific user behavior (visiting a malicious site) that defenders can influence through user education and security controls, making it a lower operational priority than the base CVSS would suggest. The vulnerability is not listed in CISA KEV, and no public exploit code is documented in the provided intelligence. The attack surface spans billions of Apple devices across six operating system families, but exploitation effectiveness depends entirely on user willingness to visit attacker-controlled websites. Organizations should prioritize patching based on device criticality and user exposure to untrusted web content rather than treating this as an urgent organizational incident response matter. The lack of active exploitation data combined with low EPSS suggests this is primarily a preventive remediation scenario rather than an active threat mitigation scenario.

An attacker crafts a malicious website containing specially formatted HTML and JavaScript designed to leak sensitive data stored on a victim's Apple device, such as authentication tokens, location history, or clipboard contents. The attacker distributes the website link via phishing email, social media, or compromised advertising networks, enticing users to click and visit. When a user on an unpatched iOS, macOS, tvOS, visionOS, or watchOS device accesses the website through the default browser or embedded webkit renderer, the crafted content exploits insufficient input validation to access and exfiltrate sensitive data to the attacker's server without alerting the user.