According to Apple, the first flaw is that "processing web content may disclose sensitive information." The second vulnerability warns that "processing web content may lead to arbitrary code execution."
Apple: The issue was discovered by researchers at the University of Toronto s Citizen Lab, who said the software flaw was being "actively exploited" to deliver commercial spyware called Pegasus developed and sold by the Israeli company NSO Group.