CVE-2026-28962 is an information disclosure vulnerability in Apple Safari caused by processing maliciously crafted web content. This flaw could allow an attacker to obtain sensitive user information due to insufficient access restrictions. Apple has fixed this issue by improving access controls in Safari 26.5 and related OS updates. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it can be exploited remotely without user interaction and has a high impact on availability. No public exploits are currently known.

Successful exploitation of this vulnerability may result in disclosure of sensitive user information. The CVSS vector indicates no confidentiality or integrity impact but a high impact on availability, which may reflect denial of service or disruption. No known active exploitation has been reported.

Apple has addressed this vulnerability with improved access restrictions and fixed it in Safari 26.5 and corresponding OS versions (iOS 18.7.9, iPadOS 18.7.9, macOS Tahoe 26.5, visionOS 26.5). Users and administrators should update affected Safari browsers and operating systems to these versions or later to remediate the issue. Patch status is confirmed fixed in these versions per the vendor advisory.