CVE-2025-43480

The issue was addressed with improved checks. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. A malicious website may exfiltrate data cross-origin.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.1 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
appleCNA
---
---
CISA-ADPADP
8.1 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 11%
VendorProductVersion
applesafari
𝑥
< 26.1
appleipados
𝑥
< 26.1
appleiphone_os
𝑥
< 26.1
appletvos
𝑥
< 26.1
applevisionos
𝑥
< 26.1
applewatchos
𝑥
< 26.1
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
webkitgtk
questing
dne
plucky
dne
noble
dne
jammy
dne
bionic
ignored
xenial
ignored
webkit2gtk
questing
not-affected
plucky
not-affected
noble
Fixed 2.46.1-0ubuntu0.24.04.1
released
jammy
Fixed 2.46.1-0ubuntu0.22.04.3
released
focal
ignored
bionic
ignored
xenial
ignored
qtwebkit-source
questing
dne
plucky
dne
noble
dne
jammy
dne
bionic
ignored
xenial
ignored
qtwebkit-opensource-src
questing
dne
plucky
dne
noble
ignored
jammy
ignored
focal
ignored
bionic
ignored
xenial
ignored
wpewebkit
questing
dne
plucky
dne
noble
dne
jammy
ignored
focal
ignored