Description
The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. A malicious website may exfiltrate data cross-origin.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apple Safari
0 to < 18.5affected
Apple iOS and iPadOS
0 to < 18.5affected
Apple macOS
0 to < 15.5affected
Apple tvOS
0 to < 18.5affected
Apple visionOS
0 to < 2.5affected
Apple watchOS
0 to < 11.5affected
References
- https://support.apple.com/en-us/122404 ↗
- https://support.apple.com/en-us/122716 ↗
- https://support.apple.com/en-us/122719 ↗
- https://support.apple.com/en-us/122720 ↗
- https://support.apple.com/en-us/122721 ↗
- https://support.apple.com/en-us/122722 ↗
- https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html ↗
- http://seclists.org/fulldisclosure/2025/May/13 ↗
- http://seclists.org/fulldisclosure/2025/May/12 ↗
- http://seclists.org/fulldisclosure/2025/May/10 ↗
- http://seclists.org/fulldisclosure/2025/May/7 ↗
- http://seclists.org/fulldisclosure/2025/May/5 ↗