This vulnerability (CVE-2026-28920) involves an information leakage flaw in Apple iOS and iPadOS that could allow sensitive data exposure when a user visits a maliciously crafted website. Apple fixed the issue by implementing additional validation checks. The fix is included in iOS 18.7.9, iPadOS 18.7.9, and corresponding updates for other Apple operating systems such as macOS Sequoia 15.7.7 and macOS Sonoma 14.8.7. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, but user interaction needed, and a confidentiality impact classified as high. Integrity and availability are not affected.

Successful exploitation can lead to sensitive data leakage on affected Apple devices when users visit malicious websites. The confidentiality impact is high, but there is no impact on integrity or availability. No known exploits are currently reported in the wild.

Apple has released official fixes for this vulnerability in iOS 18.7.9, iPadOS 18.7.9, and related updates for other Apple operating systems. Users and administrators should apply these updates promptly to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official updates.