CVE-2026-28907

Overview

Impact:

Description: Processing maliciously crafted web content may prevent Content Security Policy from being enforced

Researchers: Cantina

Attribute	Value
CVE	CVE-2026-28907
Bugzilla	308675
Component	WebKit
Bug Class	CSP Bypass
Severity	medium
Commit	5d910749e9023a7d…
Advisory	Apple Advisory

Root Cause Analysis

CSP path matching did not percent-decode path segments before comparison, allowing %2F..%2F path traversal to bypass script-src path restrictions. Fix: pathMatches() now splits on /, then percent-decodes each segment individually before comparing.

Attack Path

1. Step 1

Attacker controls a script tag src with a path-restricted CSP.

2. Step 2

Attacker encodes path traversal as %2F..%2F in the URL path.

3. Step 3

CSP pathMatches() compares raw encoded segments, allowing mismatch.

4. Step 4

Browser loads script from unauthorized directory, bypassing path restriction.

5. Step 5

Arbitrary code execution via attacker-controlled script.

Files Changed

Source Files

Tools/MobileMiniBrowser/MobileMiniBrowserFramework/SceneDelegate.m

Patch Preview

diff --git a/Tools/MobileMiniBrowser/MobileMiniBrowserFramework/SceneDelegate.m b/Tools/MobileMiniBrowser/MobileMiniBrowserFramework/SceneDelegate.m
index 0fa324aaec3a..492142235cbf 100644
--- a/Tools/MobileMiniBrowser/MobileMiniBrowserFramework/SceneDelegate.m
+++ b/Tools/MobileMiniBrowser/MobileMiniBrowserFramework/SceneDelegate.m
@@ -42,8 +42,11 @@ - (void)scene:(UIScene *)scene willConnectToSession:(UISceneSession *)session op
     UIWindow *window = [[UIWindow alloc] initWithWindowScene:(UIWindowScene *)scene];
     self.window = window;
 
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
     UIStoryboard *storyboard = [UIStoryboard storyboardWithName:@"Main" bundle:[NSBundle bundleForClass:[SceneDelegate class]]];
     WebViewController *viewController = (WebViewController *)[storyboard instantiateInitialViewController];
+#pragma clang diagnostic pop
     window.rootViewController = viewController;
 
     WKWebsiteDataStore *dataStore = viewController.dataStore;