Skip to main content

Safari CVE-2025-43227

HIGH
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)
2025-07-30 product-security@apple.com
Apple Safari iOS macOS Information Disclosure Ipados Iphone Os Tvos Visionos Watchos Red Hat Suse
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE
HIGH
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Patch released
Apr 06, 2026 - 08:30 nvd
Patch available
Analysis Generated
Apr 02, 2026 - 19:37 vuln.today
CVE Published
Jul 30, 2025 - 00:15 nvd
HIGH 7.5

DescriptionCVE.org

This issue was addressed through improved state management. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may disclose sensitive user information.

AnalysisAI

Information disclosure vulnerability in WebKit across Apple's ecosystem allows unauthenticated remote attackers to extract sensitive user information through maliciously crafted web content. The flaw affects Safari 18.x, iOS/iPadOS 18.x, macOS Sequoia 15.x, tvOS 18.x, visionOS 2.x, and watchOS 11.x, stemming from improper state management (CWE-359). Despite a CVSS score of 7.5, real-world exploitation risk remains relatively low with 0.13% EPSS probability and no public exploit identified at time of analysis. Vendor-released patches are available across all affected platforms.

Technical ContextAI

This vulnerability resides in WebKit, Apple's browser engine powering Safari and all web rendering across iOS, macOS, tvOS, visionOS, and watchOS. The root cause is classified as CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor), resulting from inadequate state management during web content processing. State management flaws in browser engines typically involve improper isolation between security contexts, failure to clear sensitive data from memory between operations, or incorrect handling of cross-origin resource boundaries. WebKit's shared architecture across Apple's ecosystem means a single vulnerability affects seven distinct product lines, making this a widespread cross-platform issue. The flaw allows passive information leakage without requiring code execution, suggesting it may exploit timing channels, cache side-effects, or improper data sanitization in browser state transitions.

RemediationAI

Apply the vendor-released patches immediately through standard Apple update mechanisms. For macOS users, upgrade to macOS Sequoia 15.6 via System Settings > General > Software Update (advisory https://support.apple.com/en-us/124147). iOS and iPadOS users should update to version 18.6 through Settings > General > Software Update (advisories https://support.apple.com/en-us/124149 and https://support.apple.com/en-us/124152). Safari users on supported macOS versions should update to Safari 18.6 (advisory https://support.apple.com/en-us/124153). Additional platform updates include tvOS 18.6 (advisory https://support.apple.com/en-us/124154), visionOS 2.6 (advisory https://support.apple.com/en-us/124155), and watchOS 11.6. Organizations managing Apple devices through MDM should push these updates centrally. As an interim mitigation where immediate patching is not feasible, restrict web browsing to trusted content sources and consider implementing network-level content filtering, though these measures provide limited protection against a client-side information disclosure vulnerability. No effective workaround exists that maintains full browser functionality while eliminating risk.

More in Safari

View all
CVE-2017-2547 HIGH POC
8.8 May 22

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2014-1303 CRITICAL POC
10.0 Mar 26

Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox

CVE-2023-43000 HIGH POC
8.8 Nov 05

A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
CVE-2016-4622 HIGH
8.8 Jul 22

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
CVE-2015-1155 MEDIUM POC
4.3 May 08

The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allo
CVE-2015-1126 MEDIUM POC
4.3 Apr 10

WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not

CVE-2017-2446 HIGH POC
8.8 Apr 02

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13802 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13795 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13794 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13792 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CVE-2017-13785 HIGH POC
8.8 Nov 13

An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi

Same weakness CWE-359 – Exposure of Private Personal Information to an Unauthorized Actor

View all
CVE-2024-11396 MEDIUM POC
5.3
CVE-2022-0482 CRITICAL POC
9.1
CVE-2025-54125 HIGH POC
8.7
CVE-2022-2921 HIGH POC
8.8
CVE-2019-25762 HIGH POC
8.7
CVE-2024-10267 HIGH POC
7.5
CVE-2020-37173 HIGH POC
7.5
CVE-2025-65857 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Enterprise Storage 7.1 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

Share

CVE-2025-43227 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy