Description
A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack.
Published: 2025-03-31
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Patch
AI Analysis

Impact

The flaw is a permissions issue that allows a malicious iframe to bypass normal sandboxing and execute script code within the context of a trusted web page, resulting in a cross‑site scripting attack. The vulnerability is specifically listed as being fixed in Safari 18.4, iOS 18.4, and iPadOS 18.4 and was observed when an attacker hosts a crafted iframe on an otherwise benign site.

Affected Systems

Apple Safari, iOS, and iPadOS are affected. The patch versions that address the issue are Safari 18.4, iOS 18.4, and iPadOS 18.4. RedHat Enterprise Linux 8, RedHat Enterprise Linux 9, and associated extended support releases (RHEL AU, E4S, EUS, TUS) are also affected. No other vendors or products are reported to be impacted at this time.

Risk and Exploitability

The CVSS score of 6.1 indicates a moderate severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, the attack vector is likely the loading of a malicious iframe within a web page in the browser, requiring the victim to visit or interact with the compromised content.

Generated by OpenCVE AI on April 28, 2026 at 11:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Safari, iOS, or iPadOS update (18.4 or newer).
  • Update RedHat Enterprise Linux or the WebKitGTK library to the latest patched version via the package manager.
  • Avoid opening untrusted web pages that may contain malicious iframes; consider using content‑filtering or browser extensions to block unknown iframes.

Generated by OpenCVE AI on April 28, 2026 at 11:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4218-1 webkit2gtk security update
Debian DSA Debian DSA DSA-5899-1 webkit2gtk security update
EUVD EUVD EUVD-2025-8987 A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack.
Ubuntu USN Ubuntu USN USN-7436-1 WebKitGTK vulnerabilities
History

Mon, 03 Nov 2025 21:30:00 +0000

Type Values Removed Values Added
References

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Mon, 07 Jul 2025 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els

Tue, 27 May 2025 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_aus:8.2

Thu, 22 May 2025 03:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_tus:8.4
cpe:/a:redhat:rhel_tus:8.6
Vendors & Products Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Tus

Mon, 05 May 2025 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_eus:8.8

Fri, 18 Apr 2025 03:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8

Thu, 10 Apr 2025 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.2
cpe:/a:redhat:rhel_eus:9.4
Vendors & Products Redhat rhel Eus

Wed, 09 Apr 2025 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux

Tue, 08 Apr 2025 02:00:00 +0000

Type Values Removed Values Added
Title webkitgtk: Loading a malicious iframe may lead to a cross-site scripting attack
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 07 Apr 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ipados
Apple iphone Os
Apple safari
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Vendors & Products Apple
Apple ipados
Apple iphone Os
Apple safari

Tue, 01 Apr 2025 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Mar 2025 22:45:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack.
References

Subscriptions

Apple Ipados Iphone Os Safari
Redhat Enterprise Linux Rhel Aus Rhel E4s Rhel Els Rhel Eus Rhel Tus
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:19:19.101Z

Reserved: 2025-01-17T00:00:45.001Z

Link: CVE-2025-24208

cve-icon Vulnrichment

Updated: 2025-04-01T20:40:45.456Z

cve-icon NVD

Status : Modified

Published: 2025-03-31T23:15:18.773

Modified: 2025-11-03T21:19:34.200

Link: CVE-2025-24208

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-04-07T00:00:00Z

Links: CVE-2025-24208 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T11:45:30Z

Weaknesses