A logic flaw in the handling of web content can allow an attacker to gain access to process memory from maliciously crafted web pages or applications. The vulnerability may reveal sensitive data stored in memory, compromising confidentiality of data that the device processes. Based on the description, the likely attack vector is through web content presented to the browser or web‑view components, and an attacker would need to lure a user to a malicious site or embed crafted content in an application.

Apple devices running iOS, iPadOS, macOS, tvOS, visionOS and watchOS are affected. The flaw is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4 and watchOS 11.4. Earlier releases of these operating systems remain vulnerable.

The CVSS score of 6.5 marks this vulnerability as a medium severity issue, and the EPSS score of 1% indicates that exploitation is possible, though relatively low in probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at the time of analysis. An attacker could exploit the flaw by directing a user to malicious web content or by embedding crafted content in an application that renders web content. Because the flaw allows disclosure of process memory, the impact could be substantial if confidential data, credentials or encryption keys are present in memory.