This vulnerability allows an attacker to trigger a disclosure of sensitive user information by delivering maliciously crafted web content that the browser processes. The flaw is related to inadequate state management, resulting in CWE-359, which permits attackers to obtain data that the user should not be able to see. A successful exploit would expose private data to the attacker while the user interacts with the affected web pages, compromising confidentiality.

Apple devices including Safari on macOS, plus iOS and iPadOS, macOS Sequoia, tvOS, visionOS, and watchOS are affected. The vulnerability is present in all releases prior to the fixes in Safari 18.6, iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6.

The CVSS score of 7.5 indicates a substantial severity, while the EPSS score of less than 1 % reveals a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would most likely need to serve malicious content to a user’s browser, meaning that user interaction or exposure to a compromised site is a prerequisite. The impact is limited to information disclosure rather than code execution or denial of service, but the sensitivity of the leaked data can be significant.