CVE-2025-43240
MEDIUMCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3Description
A logic issue was addressed with improved checks. This issue is fixed in Safari 18.6, macOS Sequoia 15.6. A download's origin may be incorrectly associated.
Analysis
Safari and macOS contain a logic flaw that allows incorrect association of a download's origin, potentially disclosing information about file provenance to local attackers. The vulnerability affects Safari 18.6 and earlier, plus macOS Sequoia 15.6 and earlier, and requires local access (no authentication needed) to exploit. This is a low-exploitation-probability issue (EPSS 0.03%) with no confirmed active exploitation or public POC at time of analysis.
Technical Context
The vulnerability stems from a logic error (CWE-703: Improper Check or Handling of Exceptional Conditions) in Safari's download metadata handling. When a user downloads a file through Safari, the browser associates the download with its origin (the webpage or domain from which it was initiated). The flaw allows this origin association to be incorrectly assigned-for example, attributing a file downloaded from one source to a different origin. This occurs in the local file system context where Safari stores download metadata. The issue affects both the Safari web browser (CPE cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*) and the underlying macOS operating system (CPE cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*), indicating the flaw may reside in shared WebKit or system-level download coordination code.
Affected Products
Safari versions prior to 18.6 and macOS Sequoia versions prior to 15.6 are affected. This encompasses Safari up to version 18.5.x on all supported macOS versions, and macOS Sequoia up to version 15.5.x. Exact version boundaries are specified in Apple security updates (https://support.apple.com/en-us/124149 for Safari and https://support.apple.com/en-us/124152 for macOS). Users running Safari 18.6 or macOS 15.6 or later are not affected. The vulnerability does not affect Safari on other platforms (iOS, iPadOS) based on the limited CPE scope, though related macOS-integrated download handling may have broader implications.
Remediation
Update Safari to version 18.6 or later, and update macOS Sequoia to version 15.6 or later. Both updates are available through Apple's official security update channels (https://support.apple.com/en-us/124149 for Safari-specific updates and https://support.apple.com/en-us/124152 for macOS system updates). Users unable to immediately patch should audit local file download histories and metadata to verify download origins match expected sources; however, no workaround exists for the underlying logic flaw, making patching the only reliable remediation. Apply these updates as part of regular security maintenance cycles rather than as emergency out-of-band patches given the low EPSS score.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today