Description

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Visiting a maliciously crafted website may leak sensitive data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T22:17:22.777Z",
  "pubdate": "2026-08-17T22:17:22.777Z",
  "executiveSummary": "This vulnerability involves an information disclosure flaw where visiting a maliciously crafted website may lead to the unauthorized leakage of sensitive data.\nThe issue impacts multiple Apple operating systems, specifically iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2.\nThe risk implications involve the potential exposure of confidential user data to an external adversary upon interacting with untrusted or maliciously crafted web content.\nAttacker capabilities require the creation and hosting of a maliciously crafted website, relying on user interaction to successfully trigger the flaw through web navigation.\nExploitation requirements dictate that a victim must visit the malicious website using an unpatched, vulnerable browser or application component on the affected systems.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation, state verification, or boundary checks within the affected web processing components of the operating systems.\nThe vulnerable component is responsible for parsing or rendering web content, handling network responses, or managing cross-origin security boundaries.\nExploitation occurs when an attacker entices a user to navigate to a maliciously crafted website via a web browser or embedded web view.\nUpon visiting the malicious site, the crafted payload interacts with the vulnerable component, exploiting the lack of robust checks to bypass security restrictions.\nThis mechanism allows unauthorized reading or exfiltration of sensitive data residing within the application context or system memory accessible to the browser process.\nNo authentication or elevated privileges are required by the attacker prior to exploitation, though the attack relies entirely on network exposure via web browsing vectors and victim interaction.\nThe attack flow follows a sequential pattern: the user opens the malicious URL, the browser processes the adversarial content, the flaw is triggered due to inadequate checks, and sensitive data is subsequently leaked back to the attacker-controlled server."
}