Description
The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin.
Published: 2025-11-04
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Cross-origin data exfiltration
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a flaw in WebKitGTK that allows a malicious web site to access and exfiltrate data from a user’s browser across origin boundaries. This flaw corresponds to information‑leak weaknesses (CWE‑200) and cross‑origin data access weaknesses (CWE‑942). Attackers could read confidential information such as cookies or credentials and send it to an external server, compromising the confidentiality of the user session. The flaw exists in the browser engine until the security update that shipped Safari 26.1, iOS 26.1, iPadOS 26.1, macOS 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1.

Affected Systems

The impacted products are Apple Safari on all supported platforms, as well as iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Versions prior to 26.1 on each platform are affected; the security fix was added in the 26.1 releases.

Risk and Exploitability

The CVSS base score is 8.1, and the EPSS score is less than 1 %, indicating a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. An attacker would need to host a malicious web page and lure a user to visit it in the affected browser. Once the page is loaded, the attacker can read data from cross‑origin web views and exfiltrate it to a location of their choosing. Because the vulnerability is purely a data‑leak issue, it requires user interaction but does not grant arbitrary code execution.

Generated by OpenCVE AI on April 22, 2026 at 21:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the security update that includes Safari 26.1, iOS 26.1, iPadOS 26.1, macOS 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1 or later on all affected devices.
  • On devices that cannot be updated immediately, configure browsers to enforce the same‑origin policy by disabling any cross‑origin resource sharing or by setting Content‑Security‑Policy headers in view controllers that load web content to disallow data access from third‑party origins.
  • Enable network monitoring or the built‑in diagnostics to look for abnormal data transfers from web views, and investigate any suspicious traffic to prevent exfiltration.

Generated by OpenCVE AI on April 22, 2026 at 21:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved checks. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. A malicious website may exfiltrate data cross-origin. The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin.

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved checks. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. A malicious website may exfiltrate data cross-origin. The issue was addressed with improved checks. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. A malicious website may exfiltrate data cross-origin.
References

Sat, 22 Nov 2025 00:15:00 +0000

Type Values Removed Values Added
Title webkitgtk: A malicious website may exfiltrate data cross-origin
Weaknesses CWE-200
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 04 Nov 2025 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple iphone Os

Tue, 04 Nov 2025 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios
Apple ipados
Apple safari
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios
Apple ipados
Apple safari
Apple tvos
Apple visionos
Apple watchos

Tue, 04 Nov 2025 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-942
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 04 Nov 2025 01:45:00 +0000

Type Values Removed Values Added
Description The issue was addressed with improved checks. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. A malicious website may exfiltrate data cross-origin.
References

Subscriptions

Apple Ios Ipados Iphone Os Safari Tvos Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:16:54.266Z

Reserved: 2025-04-16T15:24:37.126Z

Link: CVE-2025-43480

cve-icon Vulnrichment

Updated: 2025-11-04T15:35:00.641Z

cve-icon NVD

Status : Modified

Published: 2025-11-04T02:15:52.400

Modified: 2026-04-02T19:20:53.253

Link: CVE-2025-43480

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-11-20T00:00:00Z

Links: CVE-2025-43480 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T21:45:06Z

Weaknesses