The vulnerability arises from improper memory handling when parsing maliciously crafted web content, which can lead to disclosure of process memory to an unauthenticated user. This issue reflects CWE-200 (Information Exposure), CWE-119 (Improper Handling of Buffer), and CWE-416 (Use After Free). An attacker can construct a web page that, once rendered by the browser or operating system, exposes sensitive data stored in memory, potentially including private credentials or other confidential information. This constitutes a confidentiality breach rooted in unprotected read access to process memory.

Apple Safari, iOS, iPadOS, and macOS Tahoe are affected, with all versions prior to 26.5.2 vulnerable. The update to version 26.5.2 or later includes the fix that enhances memory safety for web content.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in KEV. The issue can still be exploited via client‑side web content presented to a user. The likely attack vector involves a user’s interaction with a compromised web page; this is inferred from the description that parsing malicious web content may disclose process memory. The exploitation does not require privileged access or complex setup. While the precision of risk assessment is limited, the potential impact of memory disclosure warrants prompt action.