A malicious website can exfiltrate data across origins, leaking any information that a web page can access. The flaw is client‑side and does not lead to code execution but violates confidentiality by allowing data to be sent to an external domain. The weakness aligns with CWE‑200 and has been mitigated by stricter origin checks in the fixed releases.

Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are impacted. Fixed versions are Safari 18.5, iOS 18.5, iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, and watchOS 11.5. Red‑Hat Enterprise Linux distributions (RHEL 8/9 and derivatives) that ship the WebKitGTK engine may also be affected, as the component is listed in the CPE set and could contain the vulnerable code.

The CVSS score of 6.5 places the issue in the medium severity range, while the EPSS score of less than 1 % indicates a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user visiting a crafted website or an application embedding WebKitGTK to load a malicious resource; once the page is rendered, the attacker can retrieve confidential data. No privilege escalation is required and the impact is limited to confidentiality, though the core nature of the flaw means any application using the affected engine could be exposed.