Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-28920: Visiting malicious websites can leak sensitive data on Apple devices

CVE-2026-28920 · published 5 months ago

Summary

Visiting a malicious website on an Apple device could expose sensitive information. This vulnerability has been fixed in recent updates to various Apple operating systems, so it's essential to ensure your devices are running the latest versions to stay protected. Regularly updating your devices is crucial to prevent potential data breaches.

What to do

Update apple tvos to version 26.5 or later.
Update apple visionos to version 26.5 or later.
Update apple watchos to version 26.5 or later.

Affected software

Vendor	Product	Affected versions
apple	ipados	< 18.7.9 >= 26.0, < 26.5 `cpe:2.3:o:apple:ipados::::::::`
apple	iphone_os	< 18.7.9 >= 26.0, < 26.5 `cpe:2.3:o:apple:iphone_os::::::::`
apple	macos	>= 14.0, < 14.8.7 >= 15.0, < 15.7.7 >= 26.0, < 26.5 `cpe:2.3:o:apple:macos::::::::`
apple	tvos	< 26.5 `cpe:2.3:o:apple:tvos::::::::`
apple	visionos	< 26.5 `cpe:2.3:o:apple:visionos::::::::`
apple	watchos	< 26.5 `cpe:2.3:o:apple:watchos::::::::`

Original advisory text

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Visiting a maliciously crafted website may leak sensitive data.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published11 May 2026

Updated4 Nov 2026

First seen11 May 2026

Sources

CVE-2026-28920 · NVD

Track software like this

Free during beta