Apple has discovered an input validation flaw in Safari and several Apple operating systems that can allow a malicious website to read and exfiltrate data across origins. The issue stems from the browser’s failure to properly check input boundaries, enabling cross-origin requests to leak user data. The vulnerability has been remedied by improved input validation, and affected releases are patched in Safari 26.5.2, iOS 18.7.10, iPadOS 18.7.10, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6.

Apple Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions before Safari 26.5.2, iOS 18.7.10, iPadOS 18.7.10, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6 are vulnerable. All releases after or equal to those fixes contain the patch.

Based on the description, it is inferred that a malicious website could trigger the flaw by loading a page in the affected browser; the CVE data does not explicitly state the requisite privileges or network exploitation prerequisites. The EPSS score indicates a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog, but this low probability does not diminish its potential impact. The CVSS score of 4.3 indicates a medium level of severity for this client‑side data‑exfiltration flaw.