Apple Safari vulnerabilities

CVE-2025-43427 Medium · 4.3 CWE-20 Nov 3, 2025

This issue was addressed through improved state management. This issue is fixed in iOS 26.1 and...

This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-43425 Medium · 4.3 CWE-119 Nov 3, 2025

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1,...

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-43421 Medium · 4.3 CWE-125 Nov 3, 2025

Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in iOS...

Multiple issues were addressed by disabling array allocation sinking. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-43419 High · 8.8 CWE-119 Nov 3, 2025

The issue was addressed with improved memory handling. This issue is fixed in Safari 26, tvOS 26,...

The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to memory corruption.

CVE-2025-43413 High · 7.5 CWE-284 Nov 3, 2025

An access issue was addressed with additional sandbox restrictions. This issue is fixed in...

An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A sandboxed app may be able to observe system-wide network connections.

CVE-2025-43392 Medium · 4.3 CWE-942 Nov 3, 2025

Permissive Cross-domain Policy in Apple Safari

The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A website may exfiltrate image data cross-origin.

CVE-2025-43376 High · 7.5 Nov 3, 2025

A logic issue was addressed with improved state management. This issue is fixed in Safari 26,...

A logic issue was addressed with improved state management. This issue is fixed in Safari 26, iOS 18.7.7 and iPadOS 18.7.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A remote attacker may be able to view leaked DNS queries with Private Relay turned on.

CVE-2025-43368 Medium · 4.3 CWE-416 Sep 15, 2025

A use-after-free issue was addressed with improved memory management. This issue is fixed in...

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVE-2025-43356 Medium · 6.5 CWE-200 Sep 15, 2025

The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26, Safari...

The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A website may be able to access sensor information without user consent.

CVE-2025-43343 Critical · 9.8 CWE-119 Sep 15, 2025

The issue was addressed with improved memory handling. This issue is fixed in tvOS 26, Safari 26,...

The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-43342 Critical · 9.8 CWE-20 Sep 15, 2025

A correctness issue was addressed with improved checks. This issue is fixed in tvOS 26, Safari 26...

A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-43327 Medium · 6.5 CWE-451 Sep 15, 2025

The issue was addressed by adding additional logic. This issue is fixed in Safari 26, macOS Tahoe...

The issue was addressed by adding additional logic. This issue is fixed in Safari 26, macOS Tahoe 26. Visiting a malicious website may lead to address bar spoofing.

CVE-2025-43272 Medium · 6.5 CWE-119 Sep 15, 2025

The issue was addressed with improved memory handling. This issue is fixed in Safari 26, visionOS...

The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVE-2025-31254 Medium · 5.4 CWE-863 Sep 15, 2025

This issue was addressed with improved URL validation. This issue is fixed in Safari 26, iOS 26...

This issue was addressed with improved URL validation. This issue is fixed in Safari 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to unexpected URL redirection.

CVE-2025-31277 High · 8.8 KEV High · 58 Public exploit CWE-119 Jul 29, 2025

Apple Multiple Products Buffer Overflow Vulnerability

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

CVE-2025-6558 High · 8.8 KEV High · 61 Public exploit CWE-20 Jul 15, 2025

Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2025-24201 Critical · 10.0 KEV High · 68 Public exploit CWE-787 Mar 11, 2025

Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

CVE-2024-44308 High · 8.8 KEV High · 61 Public exploit Nov 19, 2024

Apple Multiple Products Code Execution Vulnerability

The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

CVE-2024-44309 Medium · 6.3 KEV High · 53 CWE-79 Nov 19, 2024

Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

CVE-2024-23222 High · 8.8 KEV High · 61 Public exploit CWE-843 Jan 22, 2024

Apple Multiple Products WebKit Type Confusion Vulnerability

A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, visionOS 1.0.2. Processing maliciously crafted web content may lead to arbitrary code execution. This fix associated with the Coruna exploit was shipped in iOS 17.3 on January 22, 2024. This update brings that fix to devices that cannot update to the latest iOS version.

CVE-2023-42916 Medium · 6.5 KEV High · 53 CWE-125 Nov 30, 2023

Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

CVE-2023-42917 High · 8.8 KEV High · 55 CWE-787 Nov 30, 2023

Apple Multiple Products WebKit Memory Corruption Vulnerability

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

CVE-2023-41074 High · 8.8 CWE-94 Sep 27, 2023

Code Injection in Apple Safari

The issue was addressed with improved checks. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.

CVE-2022-48503 High · 8.8 KEV High · 54 CWE-129 Aug 14, 2023

Apple Multiple Products Unspecified Vulnerability

The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.

CVE-2023-37450 High · 8.8 KEV High · 56 Jul 26, 2023

Apple Multiple Products WebKit Code Execution Vulnerability

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.