This vulnerability arises from inadequate access restrictions, enabling an attacker to craft malicious web content that, when rendered by the web engine on Apple devices, may disclose sensitive user information. The flaw permits disclosure of personal or system data during normal content rendering, compromising confidentiality. No remote code execution or denial‑of‑service capabilities are described.

Vendors affected are Apple for iOS, iPadOS, macOS, visionOS, and Safari. Fixed versions include Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, and visionOS 26.5. Systems running earlier releases of any of these operating systems or Safari are susceptible.

The CVSS score is 7.5, indicating a high severity for information disclosure. The EPSS score is less than 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector involves delivering maliciously formatted web content through a browser or web‑enabled application; this is inferred from the context of maliciously crafted web content. No explicit further exploitation conditions are listed, so the mere rendering of such content suffices to trigger the information disclosure.