CVE-2026-28861: Apple Safari XSS Vulnerability

CVE-2026-28861 Overview

CVE-2026-28861 is a logic flaw vulnerability affecting Apple Safari and multiple Apple operating systems. The vulnerability stems from improper state management that allows a malicious website to access script message handlers intended for other origins. This cross-origin access violation could enable attackers to intercept or manipulate inter-process communications that should be restricted to specific web origins.

Critical Impact

A malicious website may bypass same-origin policy restrictions to access script message handlers from other origins, potentially leading to information disclosure or unauthorized actions across web contexts.

Affected Products

• Apple Safari prior to version 26.4
• Apple iOS and iPadOS prior to versions 18.7.7 and 26.4
• Apple macOS Tahoe prior to version 26.4
• Apple visionOS prior to version 26.4

Discovery Timeline

• 2026-03-25 - CVE-2026-28861 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-28861

Vulnerability Analysis

This vulnerability represents a logic issue in Apple's WebKit-based browsers and operating systems that affects how script message handlers are managed across different web origins. Script message handlers are a critical component of the WebKit architecture, enabling communication between JavaScript running in web content and native application code.

The flaw allows an attacker-controlled website to access script message handlers that should only be accessible to web content from specific, authorized origins. This bypasses fundamental same-origin policy protections that form the cornerstone of web security. When successfully exploited, the attacker could potentially read sensitive data being communicated through these handlers or inject malicious messages that appear to originate from trusted sources.

The vulnerability requires user interaction in the form of visiting a malicious website, but no authentication or special privileges are needed on the attacker's part.

Root Cause

The root cause is a logic issue in WebKit's state management for script message handlers. The vulnerability occurs because the browser fails to properly validate or enforce origin restrictions when routing script messages. This improper state management allows cross-origin access where the security model should enforce strict origin-based isolation.

Attack Vector

The attack vector is network-based, requiring the victim to navigate to an attacker-controlled or compromised website. The malicious site can then leverage the logic flaw to:

1. Register or access script message handlers associated with other origins
2. Intercept communications intended for legitimate web applications
3. Potentially extract sensitive information passed through these handlers

The attack does not require any special privileges and can be executed against any user visiting the malicious page using an unpatched Apple browser or device.

Detection Methods for CVE-2026-28861

Indicators of Compromise

• Unexpected cross-origin script message handler registrations in WebKit-based browsers
• Anomalous network requests from Safari or WebKit processes attempting to access resources from unrelated origins
• JavaScript errors or warnings related to message handler origin validation in browser developer consoles
• Unusual WebKit content process behavior indicating potential origin policy violations

Detection Strategies

• Monitor Safari and WebKit version information across managed devices to identify unpatched systems
• Implement endpoint detection rules that flag unexpected inter-origin communication patterns in browser processes
• Deploy web application firewalls with rules to detect suspicious script injection attempts targeting message handlers
• Utilize browser security telemetry to identify anomalous script message handler access patterns

Monitoring Recommendations

• Enable verbose logging for WebKit processes on high-value systems during the patch deployment period
• Monitor Apple security advisory channels for additional technical indicators or updated guidance
• Implement network-level monitoring for connections to known malicious domains attempting to exploit WebKit vulnerabilities
• Review application logs for any signs of unauthorized cross-origin data access

How to Mitigate CVE-2026-28861

Immediate Actions Required

• Update all affected Apple devices and browsers to the patched versions immediately
• Deploy Safari 26.4 across all managed macOS systems
• Update iOS and iPadOS devices to version 18.7.7 or 26.4
• Upgrade macOS Tahoe systems to version 26.4
• Update visionOS devices to version 26.4

Patch Information

Apple has released security updates addressing this vulnerability across all affected platforms. Detailed patch information is available in the following Apple Security Advisories:

• Apple Security Advisory #126792
• Apple Security Advisory #126793
• Apple Security Advisory #126794
• Apple Security Advisory #126799
• Apple Security Advisory #126800

The fix addresses the vulnerability through improved state management for script message handlers, ensuring proper origin validation is enforced.

Workarounds

• Restrict browsing to trusted websites only until patches can be applied
• Consider using alternative browsers temporarily on desktop systems where Safari is the primary browser
• Implement content security policies on internal web applications to add defense-in-depth against cross-origin attacks
• Enable additional browser security restrictions through MDM profiles for managed devices where immediate patching is not possible