Apple Safari EUVD-2026-40201

The victim must be using Apple Safari, iOS/iPadOS built-in browser, or any Safari-based browser on macOS Tahoe, all at versions prior to 26.5.2. The CVSS vector PR:N confirms no attacker-side authentication is required, but UI:R mandates that the victim actively visit an attacker-controlled or attacker-influenced webpage - passive network interception is insufficient. The attack is further constrained to confidentiality impact only (C:L/I:N/A:N): an attacker cannot modify data or cause availability disruption through this vector. Scope is unchanged (S:U), so exploitation cannot pivot beyond the browser's sandboxed context to the underlying OS. Non-Apple browsers (Chrome, Firefox) on macOS are not affected, as they do not use WebKit.

CVSS 4.3 (Medium) with AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The network attack vector and absence of privilege requirements lower the barrier to exploitation, but the mandatory user interaction (UI:R) meaningfully reduces real-world risk compared to a fully passive flaw. Confidentiality impact is rated Low (C:L), indicating partial data disclosure rather than full system or credential access. Scope is unchanged (S:U), confining impact to the browser's own context. No EPSS score was included in the provided intelligence, and this CVE does not appear in CISA KEV, suggesting exploitation has not been widely observed in the wild. No POC has been publicly identified at time of analysis. Taken together, the real-world risk is moderate: the affected surface (Safari across hundreds of millions of Apple devices) is enormous, but the limited impact class and lack of confirmed exploitation temper urgency relative to high-severity, integrity-compromising browser flaws.

An attacker registers a malicious domain and distributes a link via phishing email or malicious advertisement. When a victim on an unpatched Apple device visits the page in Safari, the page submits crafted input that bypasses Safari's origin validation logic, allowing the attacker's JavaScript to read a response or resource from a cross-origin target the victim's browser has access to - such as an authenticated internal page or session-scoped API response. The exfiltrated data is then transmitted to an attacker-controlled server. No public POC has been identified, but the low attack complexity (AC:L) indicates exploitation does not require unusual conditions once a victim visits the page.