An application may be able to circumvent user‑defined privacy settings, potentially exposing sensitive information that should have been protected by the operating system’s privacy controls. This vulnerability represents an insufficient authorization flaw that can be used to retrieve data that users have expressly chosen to keep private.

The flaw affects Apple Safari running on macOS, iOS, iPadOS, and visionOS. Apple documents that the issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, and visionOS 26.1. Systems running earlier versions of any of these products are vulnerable unless the corresponding update is applied.

With a CVSS score of 7.5, the vulnerability poses a moderate‑to‑high risk, yet the EPSS score is reported as < 1%, indicating that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is likely local or through a malicious application that has sufficient privileges to read or modify privacy settings. The compromised privilege level would allow the attacker to bypass the privacy controls set by the user.