An information leakage flaw allows data to be inadvertently exposed when a user visits a specially crafted website. The flaw can leak sensitive information that the user might consider private, such as browsing history, personal data held by applications, or other information that should remain confidential. The weakness involves improper validation of web content, a classic information‑exposure issue.

The vulnerability affects several Apple platforms: iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The affected releases are iOS 18.7.9 and iOS 26.5, iPadOS 18.7.9 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

The CVSS score is 6.5, with an EPSS score of <1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a moderate severity and a very low exploitation probability. The attack vector is inferred to be via browsing the internet: an attacker creates a malicious website that, when displayed in the device’s web engine, triggers the validation flaw and causes leakage of sensitive data. The flaw is limited to web content parsing, so a user must visit the malicious site; no remote code execution or privilege escalation is reported.