A type confusion bug in WebKitGTK's handling of malicious web content can be exploited to run arbitrary code. The flaw arises from improper state validation and is classified as a type confusion weakness (CWE‑843). When a specially crafted page is processed, the attacker can execute attacker‑supplied instructions, potentially granting full compromise of the browser context and access to user data or system resources.

Affected products include Apple Safari, Apple iOS, Apple iPadOS, Apple macOS Golden Gate, and Apple visionOS. All versions prior to 27 of each product are vulnerable; Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 contain the fix that corrects the state‑management logic.

The CVSS score is 8.8, indicating high severity for arbitrary code execution, and the EPSS score is < 1%, which denotes a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known public exploitation. The likely attack vector is the delivery of malicious content through the Safari‑based engine—an attacker must trick a user into visiting a crafted web page or opening a malicious file that triggers the browser. Given the high impact and the presence of a remediation, the risk sits at a high level but the exploitation probability remains low.