The CVE describes a cross-origin issue where the browser’s origin tracking was insufficient, allowing maliciously crafted web content to leak sensitive user information. The vulnerability pertains to the handling of security origins and can result in the disclosure of data that the user might expect to remain private, such as credentials or personal content that was accessed under a different origin. The weakness aligns with the principle of information exposure underlying CWE‑200.

Affected systems are Apple’s web browser and platform components: Safari, iOS, iPadOS, and macOS Tahoe. The vulnerability is fixed in version 26.5.2 for Safari, iOS, iPadOS, and macOS Tahoe; users running earlier releases are potentially exposed.

No EPSS score is published for this vulnerability, and it is not listed in the CISA KEV catalog, indicating that exploitation has not been observed or reported in the wild yet. Nonetheless, the nature of the flaw—cross-origin information leakage—creates an avenue for attackers who can entice users to visit malicious web sites or trick them into interacting with deceptive content. Because accessing the affected components is a common user activity, the attack vector is likely social engineering or drive‑by‑phishing. The lack of public exploit data does not diminish the risk; patching remains the most reliable mitigation.