An improved check designed to prevent unauthorized sensor data leakage failed, allowing a website to read certain device sensors without the user’s explicit permission. The flaw creates a potential privacy violation by exposing sensor data that should be gated behind user consent, as identified by the missing authentication weakness (CWE-305).

The vulnerability affects Apple’s core browsers and operating systems: Safari, iOS, iPadOS, and macOS. Discrepancies exist in versions prior to Safari 18.4, iOS 18.4, iPadOS 18.4, and macOS Sequoia 15.4, which have since been patched by Apple.

The CVSS score of 6.7 indicates moderate impact, with a very low EPSS of < 1% suggesting limited exploitation likelihood at present. The issue is not yet listed in CISA’s KEV catalog. Attackers could exploit the flaw via a malicious or compromised site, delivering scripts that read sensor data remotely once a user visits the malicious page. Proper validation and updated software mitigate this risk.