iOS and iPadOS EUVD-2026-60488

Exploitation requires the victim to actively visit a maliciously crafted website using a WebKit-based browser on an unpatched Apple device running iOS prior to 18.7.10 or 26.6.1, iPadOS prior to 18.7.10 or 26.6.1, or macOS Tahoe prior to 26.6.2. The CVSS UI:R metric confirms that user interaction - specifically navigating to the malicious page - is mandatory; passive or background exploitation without user action is not possible under this vector. The CVSS PR:N confirms no attacker-side privilege, account, or authentication is required. No special device configuration or non-default feature enablement is described in the Apple advisory. Key limiting factors: the victim must be running an unpatched OS version, the victim must be induced to visit the attacker's URL (via phishing or redirect), and the scope of leaked data is bounded to what is accessible within the browser's context on the device (S:U, no cross-system scope change).

The CVSS 3.1 score of 6.5 (Medium) reflects a realistic but bounded threat: AV:N/AC:L indicates effortless network delivery, PR:N confirms no attacker-side account or privilege is needed, but UI:R introduces a meaningful friction point requiring the victim to actively visit a malicious page. The C:H rating - high confidentiality impact with no integrity or availability effect - signals that when exploitation succeeds, the data leak is substantive rather than marginal. No EPSS score was included in the provided intelligence, which limits probabilistic exploitation forecasting; this is a notable gap given the broad deployment of the affected platform. The absence of a CISA KEV entry and no identified public POC suggests the vulnerability has not yet been weaponized at scale, though Apple's simultaneous dual-train patching indicates the company assessed it as serious enough to warrant emergency backporting to the legacy 18.x release. Even a mid-sized municipal IT team in opole managing a shared iPhone fleet should treat this as an urgent patching cycle rather than a routine update, given that the delivery mechanism requires no technical sophistication - merely inducing a user to visit a URL. The scope-unchanged metric (S:U) limits blast radius to data accessible within the victim's browser context, constraining but not eliminating real-world impact. The primary uncertainty is the exact data type exposed; Apple's advisory does not specify whether the leak involves credentials, cookies, local storage, or device-level sensitive data.

An attacker registers or compromises a web server and crafts a malicious webpage that exploits inadequate boundary checks in the Apple WebKit engine. The attacker distributes the URL via a phishing email, SMS, or embedded link in a third-party application targeting iPhone, iPad, or Mac users. When an unpatched victim visits the page, the browser processes the attacker-controlled content and leaks sensitive data - potentially including authentication tokens, cookies, or other browser-accessible private data - back to the attacker's origin without the user's awareness. No public proof-of-concept code has been identified, but the low attack complexity rating indicates the exploit mechanism does not require advanced tradecraft once the vulnerability specifics are understood.