This vulnerability in Apple Safari involves a logic issue where script message handlers, which are meant to be isolated per origin, could be accessed by a malicious website from a different origin. The flaw was resolved by improving state management in Safari 26.4 and related OS updates (iOS 18.7.7, iPadOS 18.7.7, macOS Tahoe 26.4, visionOS 26.4). The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, user interaction needed, and limited confidentiality impact without integrity or availability impact. No known exploits are reported in the wild. The Red Hat advisory linked does not provide additional remediation details beyond referencing the fix in the specified Safari and OS versions.

A malicious website could access script message handlers intended for other origins, potentially leading to unauthorized access to limited confidential data within the browser context. There is no impact on data integrity or availability. The vulnerability requires user interaction and can be exploited remotely over the network.

This issue is fixed in Safari 26.4, iOS 18.7.7, iPadOS 18.7.7, macOS Tahoe 26.4, and visionOS 26.4. Users and administrators should update affected Safari browsers and operating systems to these versions or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.