CVE-2026-28871
Logic issue in WebKit potentially leading to Cross-site Scripting
WebKitにおけるXSSに繋がりうるロジックの脆弱性
A logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4. Visiting a maliciously crafted website may lead to a cross-site scripting attack.
Disclosure Date
2026/3/24
Credit
hamayanhamayan ( @hamayanhamayan )