Copying a URL from the Web Inspector in Safari, iOS, iPadOS, or macOS Sequoia can trigger execution of arbitrary commands on the host system. The vulnerability falls under CWE‑77, indicating that user input is improperly passed to a system shell without adequate validation. If an attacker can cause a user to copy a crafted URL, the system could run malicious commands, resulting in loss of confidentiality, integrity, and potentially availability of the affected device.

Apple’s Safari browsers, including all iOS, iPadOS, and macOS platforms, are affected. The issue is resolved in Safari 18.3, iOS 18.3, iPadOS 18.3, and macOS Sequoia 15.3 and later. Users of earlier releases are at risk; no other vendors or product versions are explicitly listed as impacted beyond the Apple platforms.

The CVSS score of 8.8 marks this flaw as high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Exploitation appears to rely on the user’s interaction with the Web Inspector feature, meaning that an attacker would need to persuade or trick a user into performing a copy action, or use a local compromise channel. Once leveraged, the attacker can run system commands from the host environment.