Summary
WebKit input validation bypasses Content Security Policy. This high-severity finding affects WebKit.
Disclosure timeline
- Public disclosure
Credits
Cantina · Agent-discovered and human-verified
Vulnerability disclosure
WebKit input validation bypasses Content Security Policy
CVE-2026-28907
- Affected product
- WebKit
- Severity
- High · CVSS 8.1
- Weakness
- CWE-20
- Disclosed