Technical impact
The vulnerability is caused by insufficient UI handling that lets a malicious webpage embed an iframe targeting another site’s download preferences. By doing so, an attacker can change the target website’s download settings, influencing how files are downloaded or where they are saved. The flaw is classified as CWE-1021 and does not provide code execution, privilege escalation, or direct data access; its impact is limited to UI‑controlled configuration changes.
Affected Systems
Apple products including Safari, iOS, iPadOS, macOS Tahoe, and visionOS are affected. The security fix is incorporated from Safari 26.5 onward, as well as iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and visionOS 26.5. Versions prior to these releases remain vulnerable until the update is applied.
Risk and Exploitability
The CVSS score of 4.3 and an EPSS of <1% indicate a moderate but low probability of exploitation. The vulnerability is not in the CISA KEV catalog. The likely attack vector is a webpage that hosts a malicious iframe pointing to another site and attempting to alter its download settings. Based on the description, it is inferred that the attacker needs to trick a user into visiting such a page; no remote code execution or elevated privileges are required.
