CVE-2026-28971

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: May 11, 2026
Source updated: May 13, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

The issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. A malicious iframe may use another website’s download settings.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Safari

Vendor: Apple
Product: Safari
Platforms: Unknown
Default status: Unknown

Safari · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	26.5	Unavailable	None listed

iOS and iPadOS

Vendor: Apple
Product: iOS and iPadOS
Platforms: Unknown
Default status: Unknown

iOS and iPadOS · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	26.5	Unavailable	None listed

macOS

Vendor: Apple
Product: macOS
Platforms: Unknown
Default status: Unknown

macOS · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	26.5	Unavailable	None listed

visionOS

Vendor: Apple
Product: visionOS
Platforms: Unknown
Default status: Unknown

visionOS · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	26.5	Unavailable	None listed