CVE-2026-28859

MediumCVSS 4.3

Published: 25/03/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.64%

46th percentile - higher than 46% of all known CVEs

Summary

A vulnerability in Safari and related Apple system components allows a malicious website to process restricted web content outside the sandbox. The issue was addressed with improved memory handling.

Risk Assessment

An attacker could exploit this vulnerability to bypass sandbox isolation and gain access to sensitive data or perform unauthorized operations within the browser context.

Recommendation

Immediately update systems to Safari 26.4, iOS/iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, or watchOS 26.4.

Original NVD description (English source)

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A malicious website may be able to process restricted web content outside the sandbox.