Apple Safari EUVD-2026-40202

Exploitation requires the victim to process maliciously crafted web content using an affected Apple product - specifically Safari prior to 26.5.2 on any platform, any browser on iOS or iPadOS prior to 26.5.2 (due to mandatory WebKit usage), or Safari/WebKit on macOS Tahoe prior to 26.5.2. CVSS confirms PR:N (no attacker authentication required) and UI:R (victim must actively visit or interact with malicious content - passive network interception alone is insufficient). Exploitation is bounded to confidentiality impact (C:H); no integrity modification or availability disruption is possible through this vector. The flaw does not appear to require any non-default browser configuration or special feature to be enabled - standard web browsing with an unpatched client is sufficient for exposure.

CVSS 6.5 with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a medium-high severity limited strictly to confidentiality - no integrity or availability impact is present. The attack complexity is low and requires no privileges, but the mandatory user interaction (UI:R) is the primary limiting factor. No EPSS data was provided in the available intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. No POC has been identified. Despite the lack of confirmed exploitation, the ubiquity of Safari and WebKit across Apple's ecosystem (iPhones, iPads, Macs) means the potential exposure surface is enormous. The real-world risk is moderate: easy to trigger if a user can be socially engineered to visit a malicious page, but impact is bounded to information disclosure - credential theft, local file leakage, or session data exposure are the most plausible consequences, not full system compromise.

An attacker registers a domain and hosts a webpage containing specially crafted path references designed to exploit the WebKit path validation flaw. When a target user visits the page in an unpatched Safari or any iOS/iPadOS browser, the malicious content triggers a path traversal that reads sensitive local files - such as browser cookies, cached credentials, or application data - and returns that content to the attacker-controlled server. No public exploit code has been identified at time of analysis, but the low complexity (AC:L) of the CVSS vector suggests the exploit primitive would not require sophisticated tooling once a working technique is developed.