The vulnerability was caused by insufficient input validation that allows a malicious website to process restricted web content outside the expected sandbox. This flaw enables the attacker to breach the sandbox boundary, potentially leading to unauthorized access to the local system’s resources or execution of code beyond the browser's typical privileges. The weakness is associated with general input validation failures (CWE‑20). The issue has been fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2 and macOS Tahoe 26.5.2.

Apple products including Safari, iOS, iPadOS and macOS are impacted. Any device running a version earlier than Safari 26.5.2, iOS 26.5.2 or iPadOS 26.5.2, or macOS Tahoe 26.5.2 is vulnerable and should be updated to the stated fixes.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no current widespread exploitation. The attack vector is inferred to be a malicious website accessed through the browser. An attacker would need to host or lure a victim to a web page that exploits this input validation flaw; no user interaction beyond normal browsing is noted in the description.