VulnerabilityModified
CVE-2025-24128
Visiting a malicious website may lead to address bar spoofing.
MEDIUM 4.3EPSS 0.58%
Does this matter?
Lower severity and a low EPSS score (0.58%). Track it; it rarely justifies an emergency change on its own.
Description
The issue was addressed by adding additional logic. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. Visiting a malicious website may lead to address bar spoofing.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- EPSS
- 0.58% probability · 46th percentile
- CISA KEV
- Not listed
- Affected
- apple/safari · apple/ipados · apple/iphone os · apple/macos
- Source
- product-security@apple.com
References
- https://support.apple.com/en-us/122066Release Notes, Vendor Advisory
- https://support.apple.com/en-us/122068Release Notes, Vendor Advisory
- https://support.apple.com/en-us/122074Release Notes, Vendor Advisory
- http://seclists.org/fulldisclosure/2025/Jan/13
- http://seclists.org/fulldisclosure/2025/Jan/15
- http://seclists.org/fulldisclosure/2025/Jan/20
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.