CVE-2025-43228
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
3Description
The issue was addressed with improved UI. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6. Visiting a malicious website may lead to address bar spoofing.
Analysis
Address bar spoofing in Apple Safari, iOS, and iPadOS allows remote attackers to deceive users about the website they are visiting through malicious web content, exploiting a user interface flaw that fails to adequately distinguish legitimate from spoofed address bar information. The vulnerability affects Safari before version 18.6, iOS before 18.6, and iPadOS before 18.6, and requires user interaction to visit a malicious site. No public exploit code or active exploitation has been confirmed; the EPSS score of 0.04% reflects low real-world exploitation probability despite the network attack vector.
Technical Context
This vulnerability is rooted in CWE-451 (User Interface (UI) Misrepresentation of Critical Information), a class of flaws where security-critical UI elements fail to accurately represent system state. In this case, the address bar-a primary mechanism for users to verify website authenticity and identity-can be visually spoofed through malicious webpage crafting. The flaw affects Apple's browser engine and rendering components across Safari (macOS), iOS, and iPadOS platforms. The attack leverages the fact that modern browsers must render complex web content that can obscure, overlay, or visually mimic the UI chrome (address bar, security indicators) that users rely upon to authenticate their destination. Apple addressed this by improving UI separation and rendering logic to prevent such visual manipulation, as indicated by the fix being released in Safari 18.6, iOS 18.6, and iPadOS 18.6.
Affected Products
Apple Safari versions prior to 18.6 on all supported macOS versions (affected via CPE cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*), Apple iOS versions prior to 18.6 on iPhone models (CPE cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*), and Apple iPadOS versions prior to 18.6 on iPad models (CPE cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*:*). Specific version cutoffs are not granularly detailed in the input data, but Apple's standard versioning indicates that all versions released before the fix date in August 2025 are affected. Users should consult Apple Support documents at https://support.apple.com/en-us/124147 and https://support.apple.com/en-us/124152 for precise OS build numbers and device eligibility.
Remediation
Vendor-released patch: Safari 18.6, iOS 18.6, and iPadOS 18.6. Users should immediately update all affected devices via Apple's system Software Update mechanism (Settings > General > Software Update on iOS/iPadOS, or System Settings > General > Software Update on macOS). No workarounds are available prior to patching, though users can reduce risk by being cautious of unfamiliar URLs and verifying website legitimacy through independent channels (e.g., typing the URL directly rather than following links) until their devices are updated. Refer to Apple's official security advisories at https://support.apple.com/en-us/124147 and https://support.apple.com/en-us/124152 for complete guidance and to confirm patch availability for your device model and OS version.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today