CVE-2026-28971

No fix known EPSS <1%CVSS 4.3

The issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. A malicious iframe may use another website’s download settings.

Published 2026-05-11 · CVE record · OSV

Products: apple safari, Apple iOS and iPadOS, Apple macOS, Apple visionOS