This vulnerability involves a flaw in the state management of Safari’s private browsing mode that could allow a malicious website to track users. The issue stems from a failure to enforce strict access control on private browsing sessions, a weakness classified as CWE-284 (Improper Control of Access Permissions), which may expose identifying data that should remain hidden when the user is in private mode. The resulting privacy breach could enable persistent tracking or profiling of users who rely on private browsing to avoid data leakage.

The affected Apple products are Safari, iOS, iPadOS, macOS, tvOS, and watchOS. The specific vulnerable releases are Safari 18.4, iOS 18.4, iPadOS 18.4 or 17.7.6, macOS Sequoia 15.4, tvOS 18.4, and watchOS 11.4.

The CVSS score of 4.3 indicates a low severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to host a malicious webpage and entice a user to visit that page while the user is in Safari’s private browsing mode. The data provided does not describe a publicly available exploit, so the threat remains theoretical, though the privacy implications are significant for users employing private browsing for anonymity.