A flaw in the WebKit download handling logic can cause the browser to record a downloaded file’s origin incorrectly. This logic error leads to an improper association between the file and the webpage that initiated the download. The impact is that security checks relying on the reported origin—such as content‑security‑policy enforcement or download‑origin filtering—may be misapplied, allowing a file to be treated as coming from a trusted source when it does not.

Apple Safari and Apple macOS are affected. Versions earlier than Safari 18.6 and macOS Sequoia 15.6 lack the fix. Updating to these or later releases removes the flaw.

The CVSS base score of 6.2 categorizes the issue as medium severity, and the EPSS score of less than 1 % implies a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that a malicious web page could initiate a download that triggers the misassociation, potentially allowing the file to be treated as originating from a trusted domain. Although no active exploits are reported, the risk remains until the patch is applied.