A flaw in the way Safari and related Apple operating systems render web pages allows a malicious site to spoof the user interface. By visiting such a site, a user can be tricked into interacting with forged controls or content that appears to belong to the operating system or a trusted application. The vulnerability does not directly expose data or allow code execution, but it undermines user trust and can facilitate phishing or credential theft.

Apple Safari (patched in 18.3 and 18.4), iOS (patched in 18.3 and 18.4), iPadOS (patched in 18.3, 18.4, and 17.7.6), macOS Sequoia (patched in 15.3 and 15.4), visionOS (patched in 2.3 and 2.4) and watchOS (patched in 11.4). Current versions above the listed patches are considered secure. Those running earlier versions remain vulnerable.

The CVSS score of 4.3 indicates moderate severity. The EPSS estimate of less than 1% suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Attackers typically exploit it by embedding deceptive UI elements on a web page, so a user who visits a malicious website can be deceived. The exploitation requires no special privileges and can be performed from any device running the affected software.