CVE-2025-24113

Apple UI Spoofing via Safari and Apple Operating Systems

Published Jan 27, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

The issue was addressed with improved UI. This issue is fixed in Safari 18.3, Safari 18.4, iOS 18.3 and iPadOS 18.3, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sequoia 15.4, visionOS 2.3, visionOS 2.4, watchOS 11.4. Visiting a malicious website may lead to user interface spoofing.

Analysis

Technical impact

A flaw in the way Safari and related Apple operating systems render web pages allows a malicious site to spoof the user interface. By visiting such a site, a user can be tricked into interacting with forged controls or content that appears to belong to the operating system or a trusted application. The vulnerability does not directly expose data or allow code execution, but it undermines user trust and can facilitate phishing or credential theft.

Affected Systems

Apple Safari (patched in 18.3 and 18.4), iOS (patched in 18.3 and 18.4), iPadOS (patched in 18.3, 18.4, and 17.7.6), macOS Sequoia (patched in 15.3 and 15.4), visionOS (patched in 2.3 and 2.4) and watchOS (patched in 11.4). Current versions above the listed patches are considered secure. Those running earlier versions remain vulnerable.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity. The EPSS estimate of less than 1% suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Attackers typically exploit it by embedding deceptive UI elements on a web page, so a user who visits a malicious website can be deceived. The exploitation requires no special privileges and can be performed from any device running the affected software.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

Safari

affected

Version	Status	Constraints
`0`	affected	< 18.3
`0`	affected	< 18.4

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.3
`0`	affected	< 18.4

Apple

iPadOS

affected

Version	Status	Constraints
`0`	affected	< 17.7.6

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 15.3
`0`	affected	< 15.4

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 2.3
`0`	affected	< 2.4

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 11.4

Configuration 1 [-]

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:visionos::::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Safari to version 18.3 or later
Update iOS to version 18.3 or later
Update iPadOS to version 17.7.6 or later
Patch macOS Sequoia to version 15.3 or later
Upgrade visionOS to version 2.3 or later
Upgrade watchOS to version 11.4 or later

Generated by OpenCVE AI on April 29, 2026 at 01:02 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-3625	The issue was addressed with improved UI. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. Visiting a malicious website may lead to user interface spoofing.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.786% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://seclists.org/fulldisclosure/2025/Apr/12
http://seclists.org/fulldisclosure/2025/Apr/13
http://seclists.org/fulldisclosure/2025/Apr/2
http://seclists.org/fulldisclosure/2025/Apr/4
http://seclists.org/fulldisclosure/2025/Apr/5
http://seclists.org/fulldisclosure/2025/Apr/8
http://seclists.org/fulldisclosure/2025/Jan/12
http://seclists.org/fulldisclosure/2025/Jan/13
http://seclists.org/fulldisclosure/2025/Jan/15
http://seclists.org/fulldisclosure/2025/Jan/20
https://support.apple.com/en-us/122066
https://support.apple.com/en-us/122068
https://support.apple.com/en-us/122073
https://support.apple.com/en-us/122074
https://support.apple.com/en-us/122371
https://support.apple.com/en-us/122372
https://support.apple.com/en-us/122373
https://support.apple.com/en-us/122376
https://support.apple.com/en-us/122378
https://support.apple.com/en-us/122379

History

Apr 29, 2026 1:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Apple UI Spoofing via Safari and Apple Operating Systems

Apr 2, 2026 8:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	The issue was addressed with improved UI. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. Visiting a malicious website may lead to user interface spoofing.	The issue was addressed with improved UI. This issue is fixed in Safari 18.3, Safari 18.4, iOS 18.3 and iPadOS 18.3, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sequoia 15.4, visionOS 2.3, visionOS 2.4, watchOS 11.4. Visiting a malicious website may lead to user interface spoofing.
References		https://support.apple.com/en-us/122371 https://support.apple.com/en-us/122372 https://support.apple.com/en-us/122373 https://support.apple.com/en-us/122376 https://support.apple.com/en-us/122378 https://support.apple.com/en-us/122379

Nov 3, 2025 9:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2025/Apr/12 http://seclists.org/fulldisclosure/2025/Apr/2 http://seclists.org/fulldisclosure/2025/Apr/4 http://seclists.org/fulldisclosure/2025/Apr/5 http://seclists.org/fulldisclosure/2025/Apr/8 http://seclists.org/fulldisclosure/2025/Jan/12 http://seclists.org/fulldisclosure/2025/Jan/13 http://seclists.org/fulldisclosure/2025/Jan/15 http://seclists.org/fulldisclosure/2025/Jan/20

Nov 3, 2025 8:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2025/Apr/13

Jan 31, 2025 10:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 30, 2025 7:30 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple ipados Apple iphone Os Apple macos Apple safari Apple visionos
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:apple:safari:::::::: cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:visionos::::::::
Vendors & Products		Apple Apple ipados Apple iphone Os Apple macos Apple safari Apple visionos
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}`

Jan 27, 2025 10:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		The issue was addressed with improved UI. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. Visiting a malicious website may lead to user interface spoofing.
References		https://support.apple.com/en-us/122066 https://support.apple.com/en-us/122068 https://support.apple.com/en-us/122073 https://support.apple.com/en-us/122074