CVE-2026-28859 is a vulnerability in Apple Safari that allows a malicious website to process restricted web content outside the sandbox environment. The underlying issue was related to memory handling flaws. This vulnerability was fixed in Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4. The CVSS v3.1 base score is 4.3, indicating medium severity, with an attack vector of network, low attack complexity, no privileges required, user interaction required, and limited confidentiality impact. The vendor advisory from Red Hat confirms the fix is available and references multiple errata addressing this and related WebKitGTK+ issues.

A malicious website could exploit this vulnerability to process restricted web content outside the sandbox, potentially bypassing security boundaries intended to isolate web content. The impact is limited to confidentiality loss as per the CVSS vector, with no integrity or availability impact reported. There are no known exploits in the wild at this time.

This vulnerability is fixed in Safari 26.4 and corresponding OS versions (iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4). Users and administrators should update affected Safari versions to 26.4 or later to remediate this issue. Red Hat has issued security advisories and errata for related WebKitGTK+ packages; applying these updates is recommended for affected Red Hat Enterprise Linux systems. Patch status is confirmed by vendor advisories.