The vulnerability allows a malicious website to modify the text displayed in the browser address bar, enabling attackers to spoof the site and potentially trick users into believing they are on a legitimate domain. This form of deceptive appearance can facilitate phishing or other social‑engineering attacks by presenting a false sense of authenticity. The weakness corresponds to improper authentication controls described by CWE-290, where an attacker manipulates the authentication presentation layer to bypass expected verification contexts.

Apple Safari, iOS, iPadOS, macOS, and visionOS are affected. The issue is resolved in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, and visionOS 26.1. Earlier versions of these products remain vulnerable.

With a CVSS score of 4.3, the vulnerability is considered moderate in severity. The EPSS score of less than 1% indicates a very low but non‑zero likelihood that the flaw will be actively exploited in the wild. It is not currently listed in the CISA KEV catalog. The most likely attack vector involves a user visiting a malicious website that contains the spoofing payload; no special privileges or additional vulnerabilities are required. Once the address bar is spoofed, an attacker can direct the user to download malware or reveal credentials by appearing as a trusted site.