« Volver al listado

CVE-2026-20643

Estado: ModificadaMedia (5.4)—

A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Apple — IpadosApple — Iphone OSApple — Macos

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-20643",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-20643",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-18T13:14:53.546083Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@apple.com",
      "affectedData": [
        {
          "vendor": "Apple",
          "product": "Safari",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "26.4",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Apple",
          "product": "iOS and iPadOS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "18.7.7",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "26.3.1 (a)",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "26.4",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Apple",
          "product": "macOS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "26.3.1 (a)",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "26.3.2 (a)",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "26.4",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Apple",
          "product": "visionOS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "26.4",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-17T23:16:17.193",
  "references": [
    {
      "url": "https://support.apple.com/en-us/126604",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/126792",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/126793",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/126794",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/126799",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/126800",
      "source": "product-security@apple.com"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2026/Mar/10",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy."
    },
    {
      "lang": "es",
      "value": "Se abordó un problema de origen cruzado en la API de Navegación con una validación de entrada mejorada. Este problema se solucionó en las Mejoras de Seguridad en Segundo Plano para iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1 y macOS 26.3.2. El procesamiento de contenido web creado con fines maliciosos podría eludir la Política del Mismo Origen."
    }
  ],
  "lastModified": "2026-06-17T10:17:35.967",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9117B15-6B46-4C64-BC4A-DDF9D9FBBEB5",
              "versionEndExcluding": "26.3.1"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60C61D06-6323-4C2E-96BC-F05F0C459568",
              "versionEndExcluding": "26.3.1"
            },
            {
              "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68370079-081F-40B1-A93F-F2B042B813E4",
              "versionEndExcluding": "26.3.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-security@apple.com"
}