Apple Safari EUVD-2026-40196

Exploitation requires that the victim visit a malicious or attacker-controlled website using a vulnerable version of Safari, iOS/iPadOS, or macOS Tahoe (all versions prior to 26.5.2). No authentication or account privileges are required of the attacker (PR:N per CVSS). The user must navigate to or be redirected to the attacker's page, constituting the required user interaction (UI:R). No non-default configuration is specified as a prerequisite - the flaw appears to affect default browser operation. Exploitation is limited by: the need to direct a victim to a specific URL (requiring social engineering, phishing, or malvertising delivery), the absence of any cross-platform impact beyond Apple's ecosystem, and the lack of integrity or availability impact, constraining attacker outcomes to data exfiltration rather than code execution or device compromise.

The CVSS 3.1 base score of 6.5 (Medium) is driven by a network-reachable, low-complexity, no-privileges-required vector with high confidentiality impact, offset by the requirement for user interaction (UI:R) and no integrity or availability impact (I:N/A:N). This is a realistic and pragmatic score. The EPSS probability of 0.17% at the 6th percentile indicates that, as of analysis time, this vulnerability is not being actively scanned or exploited at scale. It is not listed in the CISA KEV catalog, and no public proof-of-concept code has been identified in the provided intelligence. Despite the low EPSS, the attack conditions are highly accessible to a motivated actor: any user who can be directed to a malicious webpage is potentially at risk. The 'sensitive data' scope is unspecified in Apple's advisory, which is typical of Apple's minimal disclosure posture; this limits precise impact scoping. Overall, this is a genuine medium-priority issue for end-user device fleets - not an immediate crisis, but one that warrants prompt patching given the trivial exploitation path once the permission bypass is reverse-engineered from the patch.

An attacker registers or compromises a website and embeds logic that exploits the permissions boundary flaw in Safari's WebKit engine. A victim browses to the page - whether through a phishing link, malvertising, or a compromised legitimate site - causing Safari to expose sensitive data (e.g., cookies, storage contents, or data from a co-located origin) to the attacker-controlled context. No public proof-of-concept has been identified at time of analysis, but the low-complexity, no-privileges-required nature of the vector means that a working exploit could be constructed by diffing the open-source WebKit patch once Apple releases it.