CVE-2026-64728
Overview
Advisory: Apple Security Advisory
Impact:
Description: Maliciously crafted web content may violate iframe sandboxing policy
Researchers: an anonymous researcher
| Attribute | Value |
|---|---|
| CVE | CVE-2026-64728 |
| Bugzilla | 313220 |
| Component | WebCore |
| Bug Class | SandboxEscape |
| Severity | medium |
| Commit | c52bbb5187e1602b… |
| Advisory | Apple Advisory |
Root Cause Analysis
A permissions issue was addressed with improved validation.
Files Changed
Source Files
Source/WebCore/loader/FrameLoader.cpp
Test Files
LayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe-expected.txtLayoutTests/http/tests/cookies/same-site/fetch-in-srcdoc-iframe-inside-cross-origin-iframe.htmlLayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe-expected.txtLayoutTests/http/tests/cookies/same-site/img-from-srcdoc-iframe-inside-cross-origin-iframe.htmlLayoutTests/http/tests/cookies/same-site/resources/record-image-cookies.pyLayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-img-inside-cross-origin-iframe.htmlLayoutTests/http/tests/cookies/same-site/resources/srcdoc-creator-inside-cross-origin-iframe.html