The vulnerability arises from a UI flaw that allows a malicious website to cause the browser’s address bar to display a spoofed URL, misleading the user about the true origin of the site. This misrepresentation can facilitate phishing attacks or other social‑engineering tactics, compromising user trust and potentially leading to credential theft. The weakness corresponds to CWE‑451, a defect that presents misleading information to the user. The CVSS score of 4.3 indicates a moderate impact, largely focused on the integrity of displayed information rather than giving direct control to the attacker.

Apple Safari, iOS, and iPadOS are affected. The flaw is fixed in Safari 18.6, iOS 18.6, and iPadOS 18.6; earlier releases of these products remain vulnerable.

The EPSS score of less than 1% suggests the exploitation probability is low, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to entice a user to visit a malicious webpage that triggers the address‑bar spoofing, making the attack vector likely browser‑based via a crafted page. Although the CVSS indicates moderate severity, the potential for user confusion warrants timely patching