The vulnerability is caused by improper state management in Apple Safari and macOS, which allows a maliciously crafted web page to execute JavaScript in the victim’s browser context. This results in universal cross‑site scripting, giving an attacker the ability to steal credentials, manipulate the session, or redirect users to malicious sites. The weakness is an input validation failure, classified as CWE‑79, and is considered a moderate security risk.

Apple Safari and Apple macOS products are affected. All releases prior to Safari 18.6 and macOS Sequoia 15.6 contain the flaw. The issue is resolved in these and later updates.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score of less than 1% suggests that it is unlikely to be currently exploited. The vulnerability has not been listed in the CISA KEV catalog. An attacker can exploit the flaw simply by delivering malicious web content to an unpatched user’s browser; no elevated privileges or additional setup are required beyond normal web navigation.