CVE-2026-43821 describes an access control vulnerability in Apple Safari and related Apple operating systems where an application could read files outside its sandbox. This issue was resolved by Apple through improved access restrictions, with the fix included in Safari 26.6 and corresponding OS versions 26.6 across iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS v3.1 base score of 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and high confidentiality impact without integrity or availability impact.

An attacker could exploit this vulnerability to read files outside the sandboxed environment of an app, potentially exposing sensitive information. The confidentiality of data is impacted, but integrity and availability are not affected. No known exploits are reported in the wild at this time.

Apple has released fixes for this vulnerability in Safari 26.6 and corresponding OS versions 26.6 for iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. Users and administrators should apply these updates to ensure the vulnerability is remediated. Patch status is confirmed by the vendor advisory indicating an official fix is available. No additional mitigation steps are specified.