The vulnerability allows an attacker to craft malicious web content that can disable or bypass the enforcement of the Content Security Policy. When such content is processed by the affected Apple operating systems, the built‑in security controls that prevent the execution of unauthorized scripts or the reading of protected data are no longer trusted, potentially enabling arbitrary code execution or data exfiltration. This flaw reflects improper input validation that fails to enforce policy constraints on user‑supplied web content.

Apple iOS versions older than 18.7.9 and 26.5, iPadOS versions older than 18.7.9 and 26.5, macOS Tahoe older than 26.5, tvOS older than 26.5, visionOS older than 26.5, and watchOS older than 26.5 are affected. Devices running any of these operating systems may process malicious web material that bypasses the Content Security Policy.

Although no CVSS or EPSS score is provided, the flaw presents a significant risk because it is exploitable through standard web browsing or an app that renders web content. A remote attacker could host or embed crafted content and entice a user to open it, thereby bypassing security controls. The absence of KEV listing does not indicate low risk, and standard security practices recommend treating the issue as high severity until an official score becomes available.