CVE-2026-28861
Overview
Advisory: Apple Security Advisory
Impact:
Description: A malicious website may be able to access script message handlers intended for other origins
Researchers: Hongze Wu and Shuaike Dong from Ant Group Infrastructure Security Team, and webb
| Attribute | Value |
|---|---|
| CVE | CVE-2026-28861 |
| Bugzilla | 307014 |
| Component | WebCore |
| Bug Class | LogicError |
| Severity | medium |
| Commit | 795ef8a1ac92461c… |
| Advisory | Apple Advisory |
Root Cause Analysis
A logic issue was addressed with improved state management.
Files Changed
Source Files
Source/WebCore/page/UserMessageHandler.cppSource/WebCore/page/UserMessageHandler.hSource/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDOMWindow.cpp
Test Files
Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewEvaluateJavaScript.mm