A logic flaw in the state management of Apple’s browsing and runtime environments can be triggered by specially crafted web content. The error leads to unexpected behavior when the system processes such input, which could be used to crash, corrupt data, or otherwise compromise the integrity or availability of the platform. The advisory notes that the issue has been addressed through improved state handling and that the fix is available in newer releases.

Apple Safari, visionOS, and watchOS are affected, with the flaw present in any version prior to 27 and fixed in Safari 27, visionOS 27, and watchOS 27. Organizations running older releases still contain the vulnerability until the stated updates are applied.

The EPSS score of <1% and the absence of this vulnerability from the CISA KEV catalog imply limited known exploitation as of now; this inference is based on the provided metrics. The CVSS score of 5.4 denotes moderate severity. As the flaw can be triggered by any web content rendered by the affected products, the likely attack vector is the delivery of maliciously crafted web content to a user’s device. In the absence of an official workaround, the primary risk stems from the failure of standard state management, and successful exploitation would require the attacker to supply such content. These conclusions are inferred from the CVSS, EPSS, and descriptive data.