Apple has identified an input validation issue in Safari and various Apple operating systems that allows a malicious website to exfiltrate data across origins. The flaw enables the attacker to read and transmit user data that was previously scoped to a different origin. The issue was addressed with improved input validation, and the following releases contain the fix: Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6.

Apple Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions prior to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6 are affected. Versions older than 26.5.2 are vulnerable, and the flaw is fixed in the listed releases for each platform.

Based on the description, it is inferred that a malicious website could trigger the flaw by loading a page in the affected browser; the CVE data does not explicitly state the requisite privileges or network exploitation prerequisites. The EPSS score indicates a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog, but this low probability does not diminish its potential impact. The CVSS score of 4.3 indicates a medium level of severity for this client‑side data‑exfiltration flaw.