CVE-2026-28861
Fixed in a distro release EPSS <1%CVSS 4.3
A logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. A malicious website may be able to access script message handlers intended for other origins.
Products: apple safari, Apple iOS and iPadOS, Apple macOS, Apple visionOS, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | webkitgtk4 | 2.52.1-1.amzn2 |
| Amazon Linux 2 | webkitgtk4-devel | 2.52.1-1.amzn2 |
| Amazon Linux 2 | webkitgtk4-jsc | 2.52.1-1.amzn2 |
| Amazon Linux 2 | webkitgtk4-jsc-devel | 2.52.1-1.amzn2 |
| Debian 12 | webkit2gtk | no fix |
| Debian 12 | wpewebkit | no fix |
| Debian 13 | webkit2gtk | 2.52.3-2~deb13u1 |
| Debian 13 | wpewebkit | no fix |
| Debian 14 | webkit2gtk | 2.52.1-1 |
| Debian 14 | wpewebkit | 2.52.1-1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | webkit2gtk3-soup2 | 2.52.1-150600.12.63.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | webkit2gtk4 | 2.52.1-150600.12.63.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP7 | webkit2gtk3 | 2.52.1-150600.12.63.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP7 | webkit2gtk4 | 2.52.1-150600.12.63.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | webkit2gtk3 | 2.52.1-150600.12.63.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | webkit2gtk3-soup2 | 2.52.1-150600.12.63.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | webkit2gtk4 | 2.52.1-150600.12.63.1 |
| SUSE Linux Enterprise Server 16.0 | webkit2gtk3 | 2.52.1-160000.1.1 |
| SUSE Linux Enterprise Server 16.0 | webkit2gtk4 | 2.52.1-160000.1.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk3 | 2.52.1-150600.12.63.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk3-soup2 | 2.52.1-150600.12.63.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | webkit2gtk4 | 2.52.1-150600.12.63.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | webkit2gtk3 | 2.52.1-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | webkit2gtk4 | 2.52.1-160000.1.1 |
| Ubuntu 16.04 LTS | qtwebkit-opensource-src | no fix |
| Ubuntu 16.04 LTS | qtwebkit-source | no fix |
| Ubuntu 16.04 LTS | webkit2gtk | no fix |
| Ubuntu 16.04 LTS | webkitgtk | no fix |
| Ubuntu 18.04 LTS | qtwebkit-opensource-src | no fix |
| Ubuntu 18.04 LTS | qtwebkit-source | no fix |
| Ubuntu 18.04 LTS | webkit2gtk | no fix |
| Ubuntu 18.04 LTS | webkitgtk | no fix |
| Ubuntu 20.04 LTS | qtwebkit-opensource-src | no fix |
| Ubuntu 20.04 LTS | webkit2gtk | no fix |
| Ubuntu 20.04 LTS | wpewebkit | no fix |
| Ubuntu 22.04 LTS | qtwebkit-opensource-src | no fix |
| Ubuntu 22.04 LTS | webkit2gtk | no fix |
| Ubuntu 22.04 LTS | wpewebkit | no fix |
| Ubuntu 24.04 LTS | qtwebkit-opensource-src | no fix |
| Ubuntu 24.04 LTS | webkit2gtk | 2.52.3-0ubuntu0.24.04.1 |
| Ubuntu 25.10 | webkit2gtk | 2.52.3-0ubuntu0.25.10.1 |
| Ubuntu 26.04 LTS | webkit2gtk | 2.52.3-0ubuntu0.26.04.2 |
| openSUSE Leap 15.6 | webkit2gtk3 | 2.52.1-150600.12.63.1 |
| openSUSE Leap 15.6 | webkit2gtk3-soup2 | 2.52.1-150600.12.63.1 |
| openSUSE Leap 15.6 | webkit2gtk4 | 2.52.1-150600.12.63.1 |
| openSUSE Leap 16.0 | webkit2gtk3 | 2.52.1-160000.1.1 |
| openSUSE Leap 16.0 | webkit2gtk3-soup2 | 2.52.1-160000.1.1 |
| openSUSE Leap 16.0 | webkit2gtk4 | 2.52.1-160000.1.1 |