CVE-2026-64728

Public on 2026-07-27

Modified on 2026-08-24

Description

A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy.

Severity

Medium

See what this means

CVSS v3 Base Score

6.5

See breakdown

Affected Packages

Platform	Package	Status
Amazon Linux 2 - Core	gtk2	Not Affected
Amazon Linux 2 - Core	gtk3	Not Affected
Amazon Linux 2023	gtk3	Not Affected
Amazon Linux 2023	gtk4	Not Affected
Amazon Linux 2 - Core	webkitgtk3	No Fix Planned
Amazon Linux 2 - Core	webkitgtk4	Pending Fix

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv3	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2026-64728 Mitre: CVE-2026-64728