A flaw in Apple’s Navigation API allows a maliciously crafted webpage to bypass the browser’s Same‑Origin Policy. The problem is rooted in insufficient input validation (CWE‑20) and can permit an attacker to read or manipulate data from other origins that the user should not have access to. The vulnerability does not provide direct code execution but can undermine data confidentiality and integrity across domains.

Apple’s Safari browser, iOS, iPadOS, macOS, and visionOS are affected when running a version prior to the Background Security Improvements that released Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4. Any device still on an earlier revision remains vulnerable until the corresponding update is installed.

The CVSS score of 5.4 indicates moderate severity. With an EPSS score below 1% and no listing in the CISA KEV catalog, public exploitation today is unlikely, but the vulnerability could be leveraged by an attacker who lures a user to a malicious site that abuses the Navigation API. The attack vector is therefore likely to be phishing or malicious webpages that a victim visits. Because the flaw is an input‑validation issue rather than a privilege‑escalation or remote‑code‑execution flaw, the impact is limited to cross‑origin data access or navigation manipulation.