This vulnerability originates from a memory initialization issue that was improved in newer firmware. Processing carefully crafted web content may disclose internal states of the application. The flaw allows an attacker to glean sensitive information such as application state or cached data through crafted web pages. It is a combination of broken access control and improper memory handling, classified as CWE-284 and CWE-909.

The flaw affects Apple’s Safari browser and the WebKit engine across all Apple platforms – iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Versions prior to 26.2 in each of these products are vulnerable; the issue has been fixed in Safari 26.2, iOS 26.2, iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2.

The CVSS score is 4.3, indicating moderate severity. The EPSS score is less than 1 %, meaning the probability of exploitation in the wild is low. The issue is not listed in the CISA KEV catalog. Exploitation requires the victim to load maliciously crafted web content, likely via a website or a phishing email, so social engineering is a plausible vector. Once accessed, an attacker can read internal state data, potentially facilitating further attacks or profiling.