A validation flaw in Apple’s web content rendering logic allows maliciously crafted pages to bypass the Content Security Policy that normally blocks inline scripting and external resource loading. When a page containing specially constructed content is rendered, the policy is not enforced, which can enable an attacker to inject and execute arbitrary JavaScript or other code. The weakness is a classic input validation failure that compromises the integrity of web content processing.

The flaw affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions prior to the patched releases described in the advisory. Specifically, iOS and iPadOS are vulnerable before iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, while macOS Tahoe, tvOS, visionOS, and watchOS are vulnerable before version 26.5.

The EPSS score is reported as < 1 %, and the CVSS score is 7.5, indicating a moderate to high severity. The vulnerability is not listed in the CISA KEV catalog and no public exploitation is confirmed. The likely attack vector involves delivering malicious web content, such as through phishing, compromised sites, or third‑party web views, which would trigger the policy bypass and permit arbitrary code execution on the victim device.