CVE-2015-5828: Apple Safari

Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days.

The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.

Affected products

• Apple Safari: up to and including 8.0.8
• Opensuse Leap: version 42.1 only

Published 2015-10-09. Last modified 2026-06-17.