CVE-2026-64713 is a privacy vulnerability in Apple Safari and related Apple operating systems where websites can determine if a user has visited specific links. This issue is classified under CWE-203 (Information Exposure Through Discrepancy). The vulnerability was resolved with improved checks in Safari 26.6 and corresponding OS versions (iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6). The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality and integrity impact but no availability impact. No known exploits in the wild have been reported at this time.

The vulnerability allows websites to infer a user's browsing history by detecting if certain links have been visited, which compromises user privacy and confidentiality. This can lead to information disclosure about user behavior and preferences. There is no reported impact on system availability.

A fix is available in Safari 26.6 and the corresponding Apple OS versions (iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6). Users and administrators should update affected Apple software to these versions or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.