This vulnerability arises from a logic flaw in state management that allows a remote attacker to view DNS queries embedded in traffic when Private Relay is turned on. The flaw enables exposure of the DNS queries an end‑user issued, thereby leaking location or request details that should be confidential. The official description states that the logic issue was addressed with improved state management and that the bug is fixed in later releases of Safari and several Apple operating systems.

Apple Safari, iOS 18.7.7 and 26, iPadOS 18.7.7 and 26, macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26 are affected. These versions have been patched to prevent the leakage of DNS queries via Private Relay.

The CVSS score of 7.5 indicates a high severity but the EPSS score of < 1% suggests that exploitation in the wild is unlikely as of this analysis. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, requiring the victim to use Private Relay and a malicious resource that triggers the logic flaw; many of the steps to exploit it are unspecified, so the exact method is inferred rather than explicitly documented.