VulnerabilityModified
CVE-2025-31254
Processing maliciously crafted web content may lead to unexpected URL redirection.
MEDIUM 5.4EPSS 0.52%
Does this matter?
Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own.
Description
This issue was addressed with improved URL validation. This issue is fixed in Safari 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to unexpected URL redirection.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.52% probability · 43th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Affected
- apple/safari · apple/ipados · apple/iphone os
- Source
- product-security@apple.com
References
- https://support.apple.com/en-us/125108Release Notes, Vendor Advisory
- https://support.apple.com/en-us/125113Release Notes, Vendor Advisory
- http://seclists.org/fulldisclosure/2025/Sep/59
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.