CVE-2025-43356 - Vulnerability Details

- webkitgtk: A website may be able to access sensor information without user consent

Description

The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A website may be able to access sensor information without user consent.

Published: 2025-09-15

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A caching mishandling flaw in the WebKitGTK engine can allow a malicious website to read sensor information such as device orientation or motion data without obtaining explicit user permission, thereby leaking private data that could be used for tracking or spying.

Affected Systems

The vulnerability affects Apple browsers that use Safari's WebKitGTK rendering engine, including Safari on macOS, iOS, iPadOS, tvOS, visionOS, and watchOS. The flaw is patched in Safari 26, iOS 18.7 and 26, iPadOS 18.7 and 26, macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26, so any device or OS version preceding these releases is susceptible.

Risk and Exploitability

The issue carries a CVSS score of 6.5, indicating moderate severity, and a very low EPSS score of less than 1%, suggesting few exploitation attempts are expected. Because the flaw can be triggered through arbitrary web content loaded in Safari, the attack vector is likely a web-based attack that does not require privileged access. The vulnerability is not listed in CISA's KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

Safari

affected

Version	Status	Constraints
`0`	affected	< 26

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7
`0`	affected	< 26

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 26

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 26

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26

Configuration 1 [-]

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor	Product	Confidence	Versions
Apple	Ios	—	—
Apple	Ipados	—	—
Apple	Macos	—	—
Apple	Safari	—	—
Apple	Tvos	—	—
Apple	Visionos	—	—
Apple	Watchos	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to Safari 26 or later and to the corresponding Apple OS releases that include the fix (iOS 18.7/26, iPadOS 18.7/26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26).
If an immediate update is not possible, adjust Safari privacy settings or apply a policy that requires explicit user consent before any sensor APIs can be accessed by untrusted web content, effectively disabling such data access by default.
After updates or configuration changes, monitor the device’s network and sensor activity logs for unusual data access and verify that no third‑party sites are able to read sensor data by reviewing permission prompts and activity reports.

Generated by OpenCVE AI on April 28, 2026 at 10:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4375-1	webkit2gtk security update
Debian DSA	DSA-6042-1	webkit2gtk security update
EUVD	EUVD-2025-29330	The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26, Safari 26, iOS 18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. A website may be able to access sensor information without user consent.
Ubuntu USN	USN-7817-1	WebKitGTK vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00054.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://seclists.org/fulldisclosure/2025/Sep/49
http://seclists.org/fulldisclosure/2025/Sep/53
http://seclists.org/fulldisclosure/2025/Sep/56
http://seclists.org/fulldisclosure/2025/Sep/57
http://seclists.org/fulldisclosure/2025/Sep/59
http://www.openwall.com/lists/oss-security/2025/09/22/3
https://nvd.nist.gov/vuln/detail/CVE-2025-43356
https://support.apple.com/en-us/125108
https://support.apple.com/en-us/125109
https://support.apple.com/en-us/125110
https://support.apple.com/en-us/125113
https://support.apple.com/en-us/125114
https://support.apple.com/en-us/125115
https://support.apple.com/en-us/125116
https://webkitgtk.org/security/WSA-2025-0006.html
https://www.cve.org/CVERecord?id=CVE-2025-43356

History

Thu, 02 Apr 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26, iOS 18.7 and iPadOS 18.7. A website may be able to access sensor information without user consent.	The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A website may be able to access sensor information without user consent.
References		https://support.apple.com/en-us/125110

Tue, 04 Nov 2025 22:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2025/09/22/3

Tue, 04 Nov 2025 02:30:00 +0000

Type	Values Removed	Values Added
References	https://support.apple.com/en-us/125110

Tue, 04 Nov 2025 01:45:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26, Safari 26, iOS 18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. A website may be able to access sensor information without user consent.	The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26, iOS 18.7 and iPadOS 18.7. A website may be able to access sensor information without user consent.

Mon, 03 Nov 2025 19:30:00 +0000

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2025/Sep/49 http://seclists.org/fulldisclosure/2025/Sep/53 http://seclists.org/fulldisclosure/2025/Sep/56 http://seclists.org/fulldisclosure/2025/Sep/57 http://seclists.org/fulldisclosure/2025/Sep/59

Wed, 24 Sep 2025 00:15:00 +0000

Type	Values Removed	Values Added
Title		webkitgtk: A website may be able to access sensor information without user consent
References		https://nvd.nist.gov/vuln/detail/CVE-2025-43356 https://webkitgtk.org/security/WSA-2025-0006.html https://www.cve.org/CVERecord?id=CVE-2025-43356
Metrics	threat_severity `None`	threat_severity `Moderate`

Wed, 17 Sep 2025 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple iphone Os
CPEs		cpe:2.3:a:apple:safari:::::::: cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:tvos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple iphone Os

Wed, 17 Sep 2025 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios Apple ipados Apple macos Apple safari Apple tvos Apple visionos Apple watchos
Vendors & Products		Apple Apple ios Apple ipados Apple macos Apple safari Apple tvos Apple visionos Apple watchos

Tue, 16 Sep 2025 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 15 Sep 2025 22:45:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved handling of caches. This issue is fixed in tvOS 26, Safari 26, iOS 18.7 and iPadOS 18.7, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. A website may be able to access sensor information without user consent.
References		https://support.apple.com/en-us/125108 https://support.apple.com/en-us/125109 https://support.apple.com/en-us/125110 https://support.apple.com/en-us/125113 https://support.apple.com/en-us/125114 https://support.apple.com/en-us/125115 https://support.apple.com/en-us/125116

Subscriptions

Apple Ios Ipados Iphone Os Macos Safari Tvos Visionos Watchos

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2025-09-15T22:34:42.384Z

Updated: 2026-04-02T18:12:37.079Z

Reserved: 2025-04-16T15:24:37.112Z

Link: CVE-2025-43356

Vulnrichment

Updated: 2025-11-04T21:10:42.964Z

NVD

Status : Modified

Published: 2025-09-15T23:15:37.530

Modified: 2026-04-02T19:20:32.753

Link: CVE-2025-43356

Redhat

Severity : Moderate

Publid Date: 2025-09-23T00:00:00Z

Links: CVE-2025-43356 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-28T11:00:14Z

Weaknesses

CWE-200

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object