The flaw arises from insufficient state handling in Safari web extensions, allowing a malicious website to collect usage data from users running the browser. The weakness is an information exposure vulnerability (CWE‑201) combined with uncontrolled resource consumption (CWE‑400), allowing a persistent state to be populated and reused across sessions. A compromised state can persist, enabling continuous tracking without the user’s consent and undermining privacy by enabling profiling of individual users.

Apple products running Safari, iOS, iPadOS, macOS, or visionOS before the 26.3 update are vulnerable. Versions earlier than 26.3 lack the state‑management fix delivered in the latest releases of each platform.

The vulnerability has a low severity rating based on its CVSS score of 4.3, and a very low likelihood of exploitation. It is not listed in the catalog of known exploited vulnerabilities. Attackers would need a user to visit a site that injects a web extension with weakened state handling, making the attack opportunistic rather than targeted. Because the issue is limited to tracking rather than code execution, applying the available patch effectively eliminates the risk.