CVE-2025-43526

Unauthorized Web API Access via File URL in Safari Lockdown Mode

View on CVE.org
Published Dec 17, 2025 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted.

Analysis

AI-generated

Technical impact

An insufficient URL validation mechanism in Safari and macOS allows a crafted file URL opened while Lockdown Mode is enabled to use Web APIs that should normally be restricted. This flaw effectively grants web content elevated privileges within a supposedly hardened environment and could enable unauthorized data access or code execution. The weakness is classified as a Server‑Side Request Forgery type (CWE‑601).

Affected Systems

Apple Safari browser and macOS operating systems are vulnerable. The vulnerability is fixed in Safari 26.2 and macOS Tahoe 26.2. No further version details are provided.

Risk and Exploitability

The CVSS score of 9.8 marks this as a critical issue, but the EPSS score of less than 1% indicates that exploitation is currently considered unlikely. Although it is not listed in the CISA KEV catalog, the potential for a privileged escalation path warrants immediate attention. An attacker could deliver a malicious file URL to a user’s browser to trigger the faulty validation, thereby gaining access to restricted Web APIs and possibly compromising the system.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Safari update (26.2 or newer).
  • Update macOS to at least version Tahoe 26.2.
  • Disable or block the file URL scheme in Safari to prevent the vulnerable request from being processed.

Generated by OpenCVE AI on April 27, 2026 at 22:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Unauthorized Web API Access via File URL in Safari Lockdown Mode
Type Values Removed Values Added
Description This issue was addressed with improved URL validation. This issue is fixed in macOS Tahoe 26.2, Safari 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted. This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted.
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Weaknesses CWE-601
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Apple
Apple macos
Apple macos Tahoe
Apple safari
Vendors & Products Apple
Apple macos
Apple macos Tahoe
Apple safari
Type Values Removed Values Added
Description This issue was addressed with improved URL validation. This issue is fixed in macOS Tahoe 26.2, Safari 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted.
References
Earlier changes (2)
Weaknesses
  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Apr 2, 2026, 6:15 PM
Reserved
Apr 16, 2025, 3:27 PM

View source JSON

Updated
Dec 18, 2025, 7:13 PM

JSON

Status
Modified
Published
Dec 17, 2025, 9:16 PM
Modified
Jun 17, 2026, 9:24 AM

View source JSON

No data.

Updated
Apr 27, 2026, 10:15 PM

JSON