CVE-2025-43227

This issue was addressed through improved state management. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may disclose sensitive user information.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/124147	Release Notes Vendor Advisory
https://support.apple.com/en-us/124149	Release Notes Vendor Advisory
https://support.apple.com/en-us/124152	Release Notes Vendor Advisory
https://support.apple.com/en-us/124153	Release Notes Vendor Advisory
https://support.apple.com/en-us/124154	Release Notes Vendor Advisory
https://support.apple.com/en-us/124155	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

History

31 Jul 2025, 20:47

Type	Values Removed	Values Added
First Time		Apple tvos Apple visionos Apple ipados Apple Apple macos Apple iphone Os Apple safari Apple watchos
References	~~() https://support.apple.com/en-us/124147 -~~	() https://support.apple.com/en-us/124147 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/124149 -~~	() https://support.apple.com/en-us/124149 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/124152 -~~	() https://support.apple.com/en-us/124152 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/124153 -~~	() https://support.apple.com/en-us/124153 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/124154 -~~	() https://support.apple.com/en-us/124154 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/124155 -~~	() https://support.apple.com/en-us/124155 - Release Notes, Vendor Advisory
CPE		cpe:2.3:a:apple:safari:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:watchos:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos::::::::

31 Jul 2025, 18:42

Type	Values Removed	Values Added
Summary	(es) Este problema se solucionó mejorando la gestión de estados. Está corregido en iOS 18.6 y iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, watchOS 11.6 y visionOS 2.6. El procesamiento de contenido web manipulado con fines malintencionados puede revelar información confidencial del usuario.	(es) Este problema se solucionó mejorando la gestión de estado. Está corregido en iOS 18.6 y iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, watchOS 11.6 y visionOS 2.6. El procesamiento de contenido web manipulado con fines malintencionados puede revelar información confidencial del usuario.

30 Jul 2025, 23:15

Type	Values Removed	Values Added
Summary	(en) This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may disclose sensitive user information.	(en) This issue was addressed through improved state management. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, watchOS 11.6, visionOS 2.6. Processing maliciously crafted web content may disclose sensitive user information.
References		() https://support.apple.com/en-us/124152 -

30 Jul 2025, 18:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
Summary		(es) Este problema se solucionó mejorando la gestión de estados. Está corregido en iOS 18.6 y iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, watchOS 11.6 y visionOS 2.6. El procesamiento de contenido web manipulado con fines malintencionados puede revelar información confidencial del usuario.
CWE		CWE-359

30 Jul 2025, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-30 00:15

Updated : 2025-07-31 20:47

NVD link : CVE-2025-43227

Mitre link : CVE-2025-43227

CVE.ORG link : CVE-2025-43227

JSON object : View

Products Affected

apple

iphone_os
macos
ipados
tvos
watchos
safari
visionos

CWE

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

7.5 /10