CVE-2026-28962

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may disclose sensitive user information

Researchers: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames, Vitaly Simonovich, Adel Bouachraoui, greenbynox

Root Cause Analysis

Pasteboard drag-and-drop and file upload paths were not validated against an allowlist. A compromised web process could register attachment identifiers pointing to arbitrary files (e.g. /etc/passwd). Fix: Added m_allowedAttachmentFilePaths HashSet to WebProcessProxy, validates paths before registration.

Attack Path

1. Step 1

Attacker compromises or spawns a malicious web process.

2. Step 2

Process registers an attachment identifier with an arbitrary file path.

3. Step 3

User initiates drag-and-drop or file upload operation.

4. Step 4

Browser reads file from attacker-controlled path without validation.

5. Step 5

Sensitive file exfiltration or unexpected file access occurs.

Files Changed

Source Files

• Source/WebCore/platform/audio/ios/MediaDeviceRouteController.mm

Patch Preview

diff --git a/Source/WebCore/platform/audio/ios/MediaDeviceRouteController.mm b/Source/WebCore/platform/audio/ios/MediaDeviceRouteController.mm
index 77ece021b66d..bafd2772a91a 100644
--- a/Source/WebCore/platform/audio/ios/MediaDeviceRouteController.mm
+++ b/Source/WebCore/platform/audio/ios/MediaDeviceRouteController.mm
@@ -31,10 +31,12 @@
 
 #if ENABLE(WIRELESS_PLAYBACK_MEDIA_PLAYER)
 
+#import "Logging.h"
 #import "MediaDeviceRoute.h"
 #import "MediaSessionHelperIOS.h"
 #import "MediaStrategy.h"
 #import "PlatformStrategies.h"
+#import <wtf/darwin/DispatchExtras.h>
 #import <WebKitAdditions/MediaDeviceRouteControllerAdditions.mm>
 
 #import <pal/ios/AVRoutingSoftLink.h>