A maliciously crafted webpage can read parts of the file system that should be inaccessible to a regular web page, allowing the browser to identify unique characteristics of the user’s environment. The flaw is a weakness in access control, classified under CWE‑862. The impact is primarily privacy‑related, potentially enabling an attacker to profile or identify the victim by revealing system configuration details.

Apple’s web browser ecosystem—including Safari, iOS, iPadOS, macOS Sequoia, and visionOS—is affected. The vulnerability is fixed in Safari 18.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, and visionOS 2.3. Based on the description, it is inferred that any version prior to these may remain vulnerable.

The CVSS score of 6.5 indicates moderate severity, and an EPSS score of less than 1% shows low current exploitation likelihood. It is not listed in the CISA KEV catalog. The likely attack vector is a user visiting a maliciously crafted webpage in the browser, without needing elevated privileges or additional network access. No remote code execution or privilege escalation is reported.