A logging flaw in Safari and macOS allowed sensitive information to be written to logs without adequate redaction, exposing confidential data. Additionally, the flaw can let a malicious application bypass browser‑extension authentication, enabling unauthorized use of extensions. The weakness corresponds to CWE‑532 and jeopardizes confidentiality and integrity of user data.

Apple Safari versions prior to 18.3 on macOS, and macOS releases before Sequoia 15.3 are impacted. The problem exists across all Safari browsers running on macOS systems where the enhanced logging and authentication checks were not yet applied. Users of older Safari builds on macOS must check for and install the policy updates.

The CVSS score of 7.5 indicates a high severity, yet the EPSS score of less than 1% implies a very low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog and is believed to be exploitable only by a local or authenticated malicious application that can install a custom extension. The attack likely requires local user interaction or privileged app installation.