The vulnerability arises from improper handling of cached image data in WebKitGTK, allowing a webpage to read and send image contents it should not have access to. This results in a confidentiality breach where sensitive image data can be exfiltrated to an external attacker, even if the data initially belonged to a trusted domain.

Apple Safari on macOS, iOS, iPadOS, tvOS, visionOS and watchOS are affected. Versions prior to Safari 26.1, iOS 18.7.2, iPadOS 18.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1 and watchOS 26.1 are vulnerable.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1 % suggests that active exploitation is currently rare, and the flaw is not listed in CISA’s KEV catalog. The likely attack scenario is inferred from the description: a user must visit a malicious site that can read cached image data belonging to a different origin; the attacker then sends that data to an external endpoint. Although the probability of exploitation is low, the impact to confidentiality warrants prompt patching.