The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. A malicious website may exfiltrate data cross-origin.
No PoCs from references.
- https://github.com/alukashenkov/Vulners-MCP
- https://github.com/w4zu/Debian_security