The host is installed with Apple Safari before 11 and is prone to a cross-origin bypass vulnerability. A flaw is present in the application, which fails to properly handle cookies for custom URL schemes. Successful exploitation may lead to cookies belonging to one origin may be sent to another origin.