An information leakage flaw allows data to be inadvertently exposed when a user visits a specially crafted website. The flaw can leak sensitive information that the user might consider private, such as browsing history, personal data held by applications, or other information that should remain confidential. The weakness involves improper validation of web content, a classic information‑exposure issue.

The vulnerability affects several Apple platforms: iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The affected releases are iOS 18.7.9 and iOS 26.5, iPadOS 18.7.9 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

No CVSS or EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so the exact exploitation probability and severity are uncertain. The attack vector is inferred to be via browsing the internet: an attacker crafts a malicious website that, when displayed, triggers the validation flaw and causes data leakage. Because the flaw is limited to web content parsing, a user must visit the malicious site; no remote code execution or privilege escalation is reported.