Description
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Visiting a malicious website may lead to user interface spoofing.
Published: 2025-11-04
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: User Interface Spoofing
Action: Patch
AI Analysis

Impact

An inconsistency in state management within the user interface can be exploited by visiting a malicious website, resulting in UI spoofing. The vulnerability is catalogued as CWE-290.

Affected Systems

Apple Safari, Apple iOS, Apple iPadOS, Apple macOS, Apple visionOS, and Apple watchOS are impacted. Versions affected include Safari 26.1, iOS 18.7.2 and 26.1, iPadOS 18.7.2 and 26.1, macOS Tahoe 26.1, visionOS 26.1, and watchOS 26.1.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate potential for exploitation, while an EPSS score of less than 1% shows extremely low current community interest in exploiting this flaw. The vulnerability is not listed in the CISA KEV catalog. The probable attack vector is a malicious website that induces the user to interact with spoofed UI elements, thereby tricking users into unintended actions. No additional prerequisites beyond visiting such a site are required.

Generated by OpenCVE AI on April 27, 2026 at 23:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Safari 26.1, iOS 18.7.2 or 26.1, iPadOS 18.7.2 or 26.1, macOS Tahoe 26.1, visionOS 26.1, and watchOS 26.1.
  • Configure device management to enforce automatic application of the latest Apple software updates across all devices.
  • Implement web filtering or DNS-based protection to block known malicious sites that could serve spoofed content while the fix is pending.

Generated by OpenCVE AI on April 27, 2026 at 23:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description An inconsistent user interface issue was addressed with improved state management. This issue is fixed in watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. Visiting a malicious website may lead to user interface spoofing. An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Visiting a malicious website may lead to user interface spoofing.

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Visiting a malicious website may lead to user interface spoofing. An inconsistent user interface issue was addressed with improved state management. This issue is fixed in watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, visionOS 26.1. Visiting a malicious website may lead to user interface spoofing.
References

Wed, 05 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
References

Wed, 05 Nov 2025 18:45:00 +0000

Type Values Removed Values Added
Description An inconsistent user interface issue was addressed with improved state management. This issue is fixed in watchOS 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. Visiting a malicious website may lead to user interface spoofing. An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. Visiting a malicious website may lead to user interface spoofing.
References

Tue, 04 Nov 2025 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple ios
Vendors & Products Apple ios

Tue, 04 Nov 2025 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ipados
Apple iphone Os
Apple safari
Apple visionos
Apple watchos
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple
Apple ipados
Apple iphone Os
Apple safari
Apple visionos
Apple watchos

Tue, 04 Nov 2025 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-290
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 04 Nov 2025 01:45:00 +0000

Type Values Removed Values Added
Description An inconsistent user interface issue was addressed with improved state management. This issue is fixed in watchOS 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. Visiting a malicious website may lead to user interface spoofing.
References

Subscriptions

Apple Ios Ipados Iphone Os Safari Visionos Watchos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:23:59.293Z

Reserved: 2025-04-16T15:27:21.193Z

Link: CVE-2025-43503

cve-icon Vulnrichment

Updated: 2025-11-04T15:00:52.896Z

cve-icon NVD

Status : Modified

Published: 2025-11-04T02:15:53.270

Modified: 2026-04-02T19:20:56.077

Link: CVE-2025-43503

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-27T23:15:06Z

Weaknesses