A vulnerability in Apple operating systems allows a malicious application to capture screenshots of sensitive information displayed in embedded views, potentially exposing private data to the attacker or third parties. The weakness is a privacy issue related to improper checks before screenshot capture, classified as CWE-200, which directly affects user confidentiality. This could enable an attacker to harvest confidential data without further system compromise.

Apple iOS and iPadOS, macOS, visionOS, and watchOS devices running versions prior to 26.1 are susceptible. The issue is fixed in iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, and watchOS 26.1.

The CVSS score of 5.5 indicates moderate severity, while an EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported. A malicious app would need to be installed on the device, implying a local or user‑initiated attack vector. Once installed, the app could capture screenshots of embedded content, leading to sensitive data disclosure.