A logic flaw in Apple's web browsing components allows a developer or malicious application to read a user's Safari history without proper authorization. This privacy breach can expose sensitive personal information and browsing habits. The weakness is a classic example of an authentication bypass, classified as CWE-285. The vulnerability does not impact system integrity or availability but allows an attacker to gather low‑level user data, a concern for compliance and privacy.

Apple Safari on macOS, iOS, and iPadOS are affected. The issue has been corrected in Safari 26.3, iOS 18.7.5, iPadOS 18.7.5, and macOS Tahoe 26.3. Users running earlier versions are potentially exposed.

The CVSS score of 3.3 denotes low severity; exploitation is straightforward if an application can be installed or already exists. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in CISA's KEV catalog. The most probable attack vector is local, where a user installs or uses an app that can read Safari history after the logic error is triggered. No additional conditions are required beyond the presence of an affected app.