This vulnerability in Apple Safari involves improper handling of maliciously crafted web content that can prevent the browser from enforcing Content Security Policy. CSP is a critical security feature designed to restrict resources the browser is allowed to load, mitigating cross-site scripting and data injection attacks. The flaw relates to input validation weaknesses (CWE-116, CWE-20). Apple fixed the issue by improving input validation in Safari 26.5 and related OS updates. The CVSS score is 8.1 (high), indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impact.

Successful exploitation could allow attackers to bypass Content Security Policy enforcement in Safari, potentially enabling cross-site scripting or data injection attacks that compromise confidentiality and integrity of user data. There is no indication of impact on availability. No known exploits in the wild have been reported at this time.

Apple has fixed this vulnerability in Safari 26.5 and corresponding OS versions (iOS 18.7.9, iPadOS 18.7.9, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5). Users and administrators should apply these updates promptly to mitigate the risk. Patch status is not explicitly stated in the provided data, so verifying the update availability and installation through Apple's official channels is recommended.