Apple WebKit CVE-2026-28971

Exploitation requires that a user on an unpatched iOS/iPadOS, macOS, or visionOS device visit a malicious web page containing a crafted iframe referencing a second origin. The attack is entirely browser-side and does not require any server-side vulnerability on the target origin. UI:R in the CVSS vector confirms user interaction (page visit) is mandatory - passive network interception is not sufficient. PR:N confirms no authentication to the attacker's site is needed. Exploitation is limited to Apple platform users running Safari or WebKit-based browsers; non-Apple platforms and non-WebKit browsers are not affected. The impact is bounded to partial confidentiality (download settings leakage or misuse) with no integrity or availability consequence, and SSVC automatable:no indicates the attack cannot be reliably automated at scale.

The CVSS 3.1 score of 4.3 (Medium) is appropriate and not inflated. AV:N reflects that no network adjacency is required - the attack is delivered via a web page. UI:R correctly captures that a user must visit the malicious page. S:U and C:L together indicate a constrained, partial confidentiality impact with no integrity or availability consequence. EPSS at 0.02% (4th percentile) strongly corroborates low exploitation likelihood, and SSVC exploitation status is explicitly 'none' with technical impact only 'partial'. SSVC automatable is 'no', meaning mass exploitation pipelines are not a realistic threat. No KEV listing and no POC further confirm this is not an actively targeted vulnerability. The XSS tag in source metadata appears to be a categorical misclassification - the CWE-1021 root cause is iframe-layer confusion, not script injection; teams should not treat this as an XSS-class risk. Real-world priority is low: the bug requires user interaction, produces only partial confidentiality impact, and shows no signs of exploitation activity.

An attacker hosts a web page embedding a malicious iframe that references a trusted target origin (such as a corporate file-sharing portal). When a user on an unpatched Apple device visits the attacker's page, the iframe exploits WebKit's improper download settings isolation to trigger a download or inherit download policies as if acting under the trusted origin's context, potentially bypassing the user's expected download prompts or attribution. No public proof-of-concept exists at the time of analysis.