Apple Safari and macOS URL Validation Vulnerability in Lockdown Mode

A vulnerability exists in Apple Safari and macOS that allows web content opened via a file URL to access Web APIs that should be restricted, particularly on Macs with Lockdown Mode enabled. This issue arises from inadequate URL validation, which could lead to unauthorized access to sensitive functionalities.

Impact

Exploitation of this vulnerability could allow web content to bypass restrictions and access Web APIs that are normally limited, potentially leading to unauthorized actions or data access.

Remediation

This vulnerability has been addressed in the latest updates of macOS Tahoe 26.2 and Safari 26.2. Users should update to these versions to mitigate the issue.