CVE-2026-28907
HighSummary
The issue concerns improper input validation, which may lead to the Content Security Policy not being enforced. It has been fixed in Safari 26.5 and iOS 18.7.9.
Risk Assessment
Maliciously crafted web content may weaken the Content Security Policy, posing risks to users and organizations.
Recommendation
It is recommended to update to the latest versions of Safari and iOS, iPadOS, macOS, tvOS, visionOS, and watchOS to minimize risk.
Other vulnerabilities in Safari, iOS, iPadOS, macOS, tvOS, visionOS, watchOS
See all- CVE-2026-43660High
A validation issue was addressed with improved logic. This issue may have prevented Content Security Policy from being enforced.
- CVE-2024-54508High
The issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to an unexpected process crash.
Original NVD description (English source)
The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.