Apple products have a flaw that allows applications to read files outside the intended sandbox boundaries. This means a malicious or compromised app could acquire sensitive information stored by other apps or the system, potentially leading to data exposure. The weakness arises from insufficient access restrictions and represents an information‑disclosure vulnerability.

Affected Apple products include Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Applications running on versions prior to Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 are vulnerable. The patch in 26.6 and later addresses the issue for each platform.

The vulnerability is local in nature and can be exploited by any application installed on the device, such as a malicious third‑party app. The CVSS score of 6.5 indicates medium severity. The EPSS score indicates a very low exploitation probability (< 1%), and the vulnerability is not listed in CISA’s known‑exploited catalog, implying it has not yet been widely leveraged. Nonetheless, the ability to read data outside the sandbox elevates the risk of confidential data exposure, especially on shared devices or in enterprise environments. Mitigating this risk requires prompt application of the vendor‑issued updates.