iOS
CVE-2025-46277
LOW
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, watchOS 26.2. An app may be able to access a user’s Safari history.
AnalysisAI
Local apps on Apple devices can access a user's Safari browsing history due to insufficient data redaction in system logging, affecting iOS, iPadOS, macOS Tahoe, and watchOS prior to version 26.2. An attacker with local app execution privileges can extract sensitive Safari history from system logs without user interaction. This vulnerability carries a 3.3 CVSS score with minimal real-world exploitation probability (EPSS 0.01%) and no known public exploits.
Technical ContextAI
This vulnerability stems from CWE-532 (Insertion of Sensitive Information into Log File), a defect in the Apple operating system's logging subsystem. Safari history data was being written to system logs without proper redaction or sanitization, creating an information disclosure channel accessible to third-party applications running with local user privileges. The issue affects the logging infrastructure across Apple's major operating systems: iOS (iPhone OS), iPadOS, macOS Tahoe, and watchOS. The vulnerability exists in versions prior to 26.2 of these platforms, all sharing the same underlying logging framework.
RemediationAI
Vendor-released patch: iOS 26.2, iPadOS 26.2, macOS Tahoe 26.2, and watchOS 26.2. Users should update their Apple devices to these versions or later to resolve the logging redaction issue. The patch improves data redaction in the system logging subsystem to prevent Safari history from being written to accessible logs. Consult Apple's official security updates at https://support.apple.com/en-us/125884 (iOS/iPadOS), https://support.apple.com/en-us/125886 (macOS), and https://support.apple.com/en-us/125890 (watchOS) for detailed update instructions specific to your device.
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today