A validation issue in Apple’s web content rendering logic was addressed with improved logic, yet the flaw allows maliciously crafted pages to bypass the Content Security Policy that normally blocks inline scripting and external resource loading. When such content is processed, the policy is not enforced, which can enable an attacker to inject and execute arbitrary JavaScript or other code. The weakness is a classic input validation failure that compromises the integrity of web content processing.

The flaw affects Safari 26.5 on macOS, iOS 18.7.9 and 26.5, iPadOS 18.7.9 and 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5 or earlier versions. Devices running any of these operating systems or browser versions prior to the mentioned patches are vulnerable.

The EPSS score is reported as < 1 %, and the CVSS score is 7.5, indicating a moderate to high severity. The vulnerability is not listed in the CISA KEV catalog and no public exploitation is confirmed. The likely attack vector involves delivering malicious web content, such as through phishing, compromised sites, or third‑party web views, which would trigger the policy bypass and permit arbitrary code execution on the victim device.