Unexpected URL Redirection in Safari

Successful exploitation can cause Safari to redirect a user to an unintended URL while processing attacker-controlled web content. This can facilitate phishing, user deception, navigation to attacker-controlled destinations, and bypass of user expectations about the legitimacy of the visited resource. Based on the provided information, there is no specific evidence here of code execution or memory corruption from this CVE.

Until patches are applied, reduce exposure by limiting access to untrusted or attacker-controlled websites and web content. Enterprise defenders can also use web filtering, anti-phishing controls, and user-awareness measures to reduce the likelihood of malicious redirection. No vendor-provided workaround beyond updating is described in the supplied content.

Apply Apple's fixes by updating affected systems to Safari 26, iOS 26, and iPadOS 26, or later versions that include the patch. Apple indicates the issue was remediated by improved URL validation.