CVE-2026-28861
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Mar 25, 2026
CISA due date
—
The record
A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | webkit2gtk3-soup2 | 0 | 2.52.1-150600.12.63.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | webkit2gtk4 | 0 | 2.52.1-150600.12.63.1 |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | webkit2gtk3 | 0 | 2.52.1-150600.12.63.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | webkit2gtk4 | 0 | 2.52.1-150600.12.63.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | webkit2gtk3 | 0 | 2.52.1-150600.12.63.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | webkit2gtk3-soup2 | 0 | 2.52.1-150600.12.63.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | webkit2gtk4 | 0 | 2.52.1-150600.12.63.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk3 | 0 | 2.52.1-150600.12.63.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk3-soup2 | 0 | 2.52.1-150600.12.63.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk4 | 0 | 2.52.1-150600.12.63.1 |
| openSUSE:Leap 15.6 | webkit2gtk3 | 0 | 2.52.1-150600.12.63.1 |
| openSUSE:Leap 15.6 | webkit2gtk3-soup2 | 0 | 2.52.1-150600.12.63.1 |
| openSUSE:Leap 15.6 | webkit2gtk4 | 0 | 2.52.1-150600.12.63.1 |
| openSUSE:Leap 16.0 | webkit2gtk3 | 0 | 2.52.1-160000.1.1 |
| openSUSE:Leap 16.0 | webkit2gtk3-soup2 | 0 | 2.52.1-160000.1.1 |
| openSUSE:Leap 16.0 | webkit2gtk4 | 0 | 2.52.1-160000.1.1 |
Related vulnerabilities
- CVE-2026-28871 A logic issue was addressed with improved checks. Also affects webkit2gtk3-soup2
- CVE-2026-28859 The issue was addressed with improved memory handling. Also affects webkit2gtk3-soup2
- CVE-2026-28857 The issue was addressed with improved memory handling. Also affects webkit2gtk3-soup2
- CVE-2026-20665 This issue was addressed through improved state management. Also affects webkit2gtk3-soup2
- CVE-2026-20691 An authorization issue was addressed with improved state management. Also affects webkit2gtk3-soup2
- CVE-2026-20664 The issue was addressed with improved memory handling. Also affects webkit2gtk3-soup2
- CVE-2026-20643 A cross-origin issue in the Navigation API was addressed with improved input validation. Also affects webkit2gtk3-soup2
- CVE-2023-43010 The issue was addressed with improved memory handling. Also affects webkit2gtk3-soup2