CVE-2026-28971
Overview
Advisory: Apple Security Advisory
Impact:
Description: A malicious iframe may use another website’s download settings
Researchers: Khiem Tran
| Attribute | Value |
|---|---|
| CVE | CVE-2026-28971 |
| Bugzilla | 311288 |
| Component | WebKit |
| Bug Class | LogicError |
| Severity | medium |
| Commit | 4b574bf8287b6b57… |
| Advisory | Apple Advisory |
Root Cause Analysis
Safe Browsing checks were asynchronous and could complete after the navigation policy decision had already proceeded to download. This allowed malicious downloads to start before the Safe Browsing warning was shown. Fix: decidePolicyForNavigationAction and decidePolicyForResponseShared now defer download decisions until whenSafeBrowsingCheckCompletes fires.
Attack Path
1. Step 1
Attacker hosts a known-malicious file on a CDN or compromised site.
2. Step 2
User clicks download link or navigates to the file.
3. Step 3
Safe Browsing check is initiated but takes time.
4. Step 4
Policy decision proceeds to download before Safe Browsing result returns.
5. Step 5
Malicious file downloads without warning; user may execute it.
Files Changed
Source Files
Source/WebKit/UIProcess/API/APINavigation.cppSource/WebKit/UIProcess/API/APINavigation.hSource/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mmSource/WebKit/UIProcess/WebPageProxy.cpp
Test Files
Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SafeBrowsing.mm