CVE-2025-43356

The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26, iOS 18.7 and iPadOS 18.7. A website may be able to access sensor information without user consent.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
appleCNA
---
---
CISA-ADPADP
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 18%
VendorProductVersion
applesafari
𝑥
< 26.0
appleipados
𝑥
< 18.7
appleiphone_os
𝑥
< 18.7
applemacos
𝑥
< 26.0
appletvos
𝑥
< 26.0
applevisionos
𝑥
< 26.0
applewatchos
𝑥
< 26.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://support.apple.com/en-us/125108
https://support.apple.com/en-us/125109
https://support.apple.com/en-us/125113
https://support.apple.com/en-us/125114
https://support.apple.com/en-us/125115
https://support.apple.com/en-us/125116
http://seclists.org/fulldisclosure/2025/Sep/49
http://seclists.org/fulldisclosure/2025/Sep/53
http://seclists.org/fulldisclosure/2025/Sep/56
http://seclists.org/fulldisclosure/2025/Sep/57
http://seclists.org/fulldisclosure/2025/Sep/59
http://www.openwall.com/lists/oss-security/2025/09/22/3