A vulnerability in Safari, iOS, iPadOS, macOS, and visionOS allows a malicious website to exploit the script import handling mechanism and bypass isolation controls, enabling the page to read data that should be protected. The flaw can lead to the leakage of sensitive information when a user simply visits the site. The weakness arises from inadequate isolation of imported scripts, which is reflected by information‑disclosure weaknesses.

Apple's Safari browser, iOS, iPadOS, macOS, and visionOS are affected. In particular, any release before Safari 18.4, iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, or visionOS 2.4 can be exploited; these versions should be updated to the listed releases or later.

The CVSS score of 6.5 conveys a medium‑severity risk. With an EPSS below 1 % the likelihood of current exploitation is very low, and the flaw is not listed in CISA’s KEV catalog. The attack vector is remote; a user must simply visit a malicious site that triggers the vulnerable script import, and the attacker can read otherwise protected data, which constitutes an information‑disclosure scenario.