CVE-2026-28962
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
This issue was addressed with improved access restrictions. The vulnerability may lead to the disclosure of sensitive user information due to processing maliciously crafted web content.
Risk Assessment
Organizations may be exposed to the leakage of sensitive user data, which can lead to serious legal and reputational consequences.
Recommendation
It is recommended to update to the latest versions of Safari, iOS, iPadOS, and macOS to protect against this vulnerability.
Other vulnerabilities in Safari, iOS, iPadOS, macOS, visionOS
See all- CVE-2024-44309MediumActively exploited
A cookie management issue was addressed with improved state management. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
- CVE-2025-43535Medium
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
- CVE-2025-43501Medium
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Original NVD description (English source)
This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may disclose sensitive user information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS