This vulnerability involves UI spoofing in Apple Safari triggered by websites that frame malicious content. The issue could allow attackers to present deceptive user interface elements to users. Apple fixed this vulnerability in Safari 26.6, as well as iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6 by improving the UI handling to prevent spoofing. The CVSS score is 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker could exploit this vulnerability by hosting malicious content framed within a website to spoof the Safari user interface. This may lead to users being deceived into interacting with fake UI elements, potentially resulting in unauthorized actions or information disclosure. There is no direct confidentiality or availability impact, but the integrity of the user interface can be compromised.

This vulnerability is fixed in Safari 26.6 and the corresponding OS versions (iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6). Users and administrators should update to these versions to remediate the issue. Patch status is confirmed by the vendor advisory stating the issue is addressed with improved UI in these versions.