Safari and macOS versions prior to 26 suffer from an address bar spoofing flaw that allows a crafted website to cause Safari to display a false address bar, deceiving users into believing they are on a legitimate site. The flaw is categorized as CWE-451, revealing information that an attacker can abuse to mislead users. The consequences include phishing, credential theft, or broader social engineering attacks.

Apple Safari and macOS Tahoe releases up through version 26 are affected. Any installation of these product families that predates Safari 26 or macOS Tahoe 26 remains vulnerable until the appropriate update is applied.

The CVSS score of 6.5 places the vulnerability in the moderate‑to‑high range. The EPSS score of less than 1% indicates a low likelihood of exploitation at this time, and the flaw is not listed in the CISA KEV catalog. Exploitation requires a user to visit a malicious web page, so the attack vector is web‑based. While the impact is significant if exploited, the overall risk is moderated by the low exploitation probability and the availability of a patch.