Apple Safari EUVD-2026-40219

Exploitation requires that a victim actively visit or be redirected to a maliciously crafted webpage using an unpatched version of Safari, or any browser on an unpatched iOS or iPadOS device (since all iOS/iPadOS browsers use WebKit). The CVSS vector (PR:N/UI:R/AC:L) confirms no attacker authentication or special privilege is needed, but user interaction - specifically, the victim visiting the attacker-controlled or attacker-influenced content - is mandatory. No non-default configuration is required on the victim's device; the vulnerability exists in the WebKit engine's baseline same-origin enforcement. Exploitation is limited by: (1) the UI:R requirement preventing fully automated, zero-click compromise; (2) platform scope restricted to Apple devices running WebKit prior to version 26.5.2; and (3) impact limited to confidentiality only - attackers cannot modify data or cause denial of service through this vector alone.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity attack requiring no privileges and only passive user interaction - visiting a malicious page - with high confidentiality impact. The UI:R constraint is the primary limiting factor suppressing the score below 7.5 and reducing automation potential. No EPSS score was supplied, so exploitation probability cannot be quantified numerically; however, the absence of a KEV listing and no identified public POC indicates exploitation is not confirmed as widespread or active. The C:H rating is significant: cross-origin data leakage can expose authentication tokens, session cookies, or sensitive page content from trusted origins the user is concurrently authenticated to. The real-world risk is amplified by the enormous deployment footprint - Safari is dominant on macOS and the only rendering engine permissible on iOS/iPadOS, meaning hundreds of millions of devices are in scope. Low attack complexity (AC:L) suggests that once the technique is known, exploitation would not be technically demanding. The risk profile warrants urgent patching despite the absence of confirmed active exploitation.

An attacker registers or compromises a website and embeds crafted JavaScript or web content that exploits the cross-origin origin-tracking flaw. When a victim on an unpatched Safari, iOS, or iPadOS device visits the malicious page - via a phishing email, malvertising, or a compromised legitimate site - the attacker's content can read sensitive data (such as authentication tokens or page content) from other origins the user is concurrently logged into. No public POC has been identified, but the AC:L CVSS rating indicates the technique would be straightforward to implement once the root cause is understood.