Description
This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted.
Published: 2025-12-17
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized API Access
Action: Patch Immediately
AI Analysis

Impact

An insufficient URL validation mechanism in Safari and macOS allows a crafted file URL opened while Lockdown Mode is enabled to use Web APIs that should normally be restricted. This flaw effectively grants web content elevated privileges within a supposedly hardened environment and could enable unauthorized data access or code execution. The weakness is classified as a Server‑Side Request Forgery type (CWE‑601).

Affected Systems

Apple Safari browser and macOS operating systems are vulnerable. The vulnerability is fixed in Safari 26.2 and macOS Tahoe 26.2. No further version details are provided.

Risk and Exploitability

The CVSS score of 9.8 marks this as a critical issue, but the EPSS score of less than 1% indicates that exploitation is currently considered unlikely. Although it is not listed in the CISA KEV catalog, the potential for a privileged escalation path warrants immediate attention. An attacker could deliver a malicious file URL to a user’s browser to trigger the faulty validation, thereby gaining access to restricted Web APIs and possibly compromising the system.

Generated by OpenCVE AI on April 27, 2026 at 22:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Safari update (26.2 or newer).
  • Update macOS to at least version Tahoe 26.2.
  • Disable or block the file URL scheme in Safari to prevent the vulnerable request from being processed.

Generated by OpenCVE AI on April 27, 2026 at 22:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Apr 2026 22:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Web API Access via File URL in Safari Lockdown Mode

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description This issue was addressed with improved URL validation. This issue is fixed in macOS Tahoe 26.2, Safari 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted. This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted.

Fri, 19 Dec 2025 00:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 18 Dec 2025 20:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Thu, 18 Dec 2025 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-601
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 18 Dec 2025 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Apple macos Tahoe
Apple safari
Vendors & Products Apple
Apple macos
Apple macos Tahoe
Apple safari

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description This issue was addressed with improved URL validation. This issue is fixed in macOS Tahoe 26.2, Safari 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted.
References

Subscriptions

Apple Macos Macos Tahoe Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:15:34.281Z

Reserved: 2025-04-16T15:27:21.197Z

Link: CVE-2025-43526

cve-icon Vulnrichment

Updated: 2025-12-18T19:13:19.072Z

cve-icon NVD

Status : Modified

Published: 2025-12-17T21:16:11.323

Modified: 2026-04-02T19:20:59.720

Link: CVE-2025-43526

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-27T22:15:15Z

Weaknesses