An Apple software flaw allows a download’s origin to be incorrectly associated, meaning a file obtained from a malicious source could be treated as if it came from a trusted domain or application. The vulnerability originates from the way state is handled during download completion, and the lack of proper origin verification means a malicious file could be executed with the privileges of the user’s context. Because the flaw can lead to arbitrary code execution, it poses a significant threat to confidentiality, integrity, and availability of the affected systems.

Apple’s browsers and operating systems are impacted: Safari (up to 18.3), iOS and iPadOS (prior to 18.4), macOS Sequoia (pre‑15.4), and watchOS (pre‑11.4). The issue is documented as fixed in Safari 18.4, iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, and watchOS 11.4. System administrators should verify that all Apple products are running one of the patched releases or newer.

The CVSS score of 9.8 indicates critical severity. The EPSS score of less than 1% suggests that, at present, the probability of active exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the attack vector is likely a web‑based or download‑based scenario where an attacker provides a file that appears to originate from a trusted source, enabling privilege escalation or data compromise if the file is executed.