A flaw in the way Apple browsers and operating systems handle link visitation information allows a website to discover whether a user has previously visited a particular URL. This weakness exposes the user’s browsing history to third‑party sites, thereby compromising privacy and potentially enabling covert tracking. The vulnerability is rooted in insufficient validation of link‑state data and results in an information‑exposure error.

Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS operating systems prior to version 26.6 are affected, as the vulnerability is fixed in all these products with the 26.6 update.

The EPSS score indicates a very low probability (< 1%), and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 8.1 indicates high severity. The attack vector is browser‑based, requiring a malicious website to present a crafted page to the user. While the risk to confidentiality is real, the lack of a publicly known exploitation method and the need for user interaction suggest a moderate to low likelihood of widespread exploitation.