The flaw allows a malicious website to display a forged fully‑qualified domain name in the title of a pop‑up window in Safari. The spoofed text can mislead users into believing they are interacting with a trusted domain, potentially facilitating phishing or social‑engineering attacks. This weakness is described by CWE‑451 and does not provide code execution or privilege escalation, but it can compromise user trust and confidentiality by revealing misleading domain information.

Apple Safari versions earlier than 18.5 and macOS releases earlier than Sequoia 15.5 are susceptible. The vulnerability affects the standard Safari application bundled with macOS and is not limited to a specific model or build. Users of older macOS or Safari editions must be aware that their browsers may display spoofed domain names in pop‑up window titles.

The CVSS score of 4.3 indicates a low‑to‑moderate impact, and the EPSS score of less than 1% shows a very low probability of exploitation today. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to trick users into visiting a malicious site that generates a spoofed pop‑up; no network‑based attack or remote code execution is required.