CVE-2026-28871
Overview
Advisory: Apple Security Advisory
Impact:
Description: Visiting a maliciously crafted website may lead to a cross-site scripting attack
Researchers: @hamayanhamayan
| Attribute | Value |
|---|---|
| CVE | CVE-2026-28871 |
| Bugzilla | 305859 |
| Component | WebCore |
| Bug Class | LogicError |
| Severity | medium |
| Commit | 59efb640749a3024… |
| Advisory | Apple Advisory |
Root Cause Analysis
A logic issue was addressed with improved checks.
Files Changed
Source Files
Source/WebCore/dom/DOMImplementation.cppSource/WebCore/platform/MIMETypeRegistry.cppSource/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm
Test Files
LayoutTests/media/iframe-load-html-as-m2ts-expected.txtLayoutTests/media/iframe-load-html-as-m2ts.html