Safari Apple Safari

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in Apple Safari.

Recent Apple Safari Security Advisories

Advisory Title Published
122719 Safari 18.5 - Apple Security Content May 12, 2025
122379 Safari 18.4 - Apple Security Content March 31, 2025
122285 Safari 18.3.1 - Apple Security Content March 11, 2025
122074 Safari 18.3 - Apple Security Content January 27, 2025
121846 Safari 18.2 - Apple Security Content December 11, 2024
121756 Safari 18.1.1 - Apple Security Content November 19, 2024
121571 Safari 18.1 - Apple Security Content October 29, 2024
121241 Safari 18 - Apple Security Content September 16, 2024
HT214121 Safari 17.6 Security Content July 29, 2024
HT214103 Safari 17.5 Security Content May 13, 2024

Known Exploited Apple Safari Vulnerabilities

The following Apple Safari vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title Description Added
Apple Safari Webkit Browser Engine Buffer Overflow Vulnerability Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVE-2021-30665 Exploit Probability: 0.6%
November 3, 2021
Apple Safari Webkit Browser Engine Integer Overflow Vulnerability Integer overflow. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2021-30663 Exploit Probability: 0.2%
November 3, 2021

By the Year

In 2025 there have been 41 vulnerabilities in Apple Safari with an average score of 6.8 out of ten. Last year, in 2024 Safari had 57 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Safari in 2025 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2025 is greater by 0.00.




Year Vulnerabilities Average Score
2025 41 6.79
2024 57 6.79
2023 44 7.87
2022 41 7.81
2021 35 7.66
2020 59 7.23
2019 166 8.13
2018 41 8.11

It may take a day or so for new Safari vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Apple Safari Security Vulnerabilities

This issue was addressed through improved state management

CVE-2025-30466 - May 29, 2025

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, visionOS 2.4, macOS Sequoia 15.4. A website may be able to bypass Same Origin Policy.

The issue was addressed with improved checks

CVE-2025-24189 - May 19, 2025

The issue was addressed with improved checks. This issue is fixed in Safari 18.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing maliciously crafted web content may lead to memory corruption.

This issue was addressed with improved memory handling

CVE-2025-31257 - May 12, 2025

This issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

The issue was addressed with improved checks

CVE-2025-31205 - May 12, 2025

The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. A malicious website may exfiltrate data cross-origin.

A type confusion issue was addressed with improved state handling

CVE-2025-31206 - May 12, 2025

A type confusion issue was addressed with improved state handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

The issue was addressed with improved checks

CVE-2025-31215 - May 12, 2025

The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected process crash.

The issue was addressed with improved input validation

CVE-2025-31217 - May 12, 2025

The issue was addressed with improved input validation. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.

The issue was addressed with improved memory handling

CVE-2025-31204 - May 12, 2025

The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.

The issue was addressed with improved memory handling

CVE-2025-24223 - May 12, 2025

The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.

The issue was addressed with improved checks

CVE-2025-31238 - May 12, 2025

The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.

The issue was addressed with improved checks

CVE-2025-31223 - May 12, 2025

The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.

A use-after-free issue was addressed with improved memory management

CVE-2023-42970 - April 11, 2025

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari 17. Processing web content may lead to arbitrary code execution.

Processing web content may lead to arbitrary code execution

CVE-2023-42875 - April 11, 2025

Processing web content may lead to arbitrary code execution. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari 17. The issue was addressed with improved memory handling.

This issue was addressed with improved permissions checking

CVE-2025-31184 - March 31, 2025

This issue was addressed with improved permissions checking. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may gain unauthorized access to Local Network.

The issue was addressed with improved input validation

CVE-2025-24180 - March 31, 2025

The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A malicious website may be able to claim WebAuthn credentials from another website that shares a registrable suffix.

This issue was addressed through improved state management

CVE-2025-30425 - March 31, 2025

This issue was addressed through improved state management. This issue is fixed in tvOS 18.4, Safari 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A malicious website may be able to track users in Safari private browsing mode.

A use-after-free issue was addressed with improved memory management

CVE-2025-30427 - March 31, 2025

A use-after-free issue was addressed with improved memory management. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.

A script imports issue was addressed with improved isolation

CVE-2025-24192 - March 31, 2025

A script imports issue was addressed with improved isolation. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Visiting a website may leak sensitive data.

A permissions issue was addressed with additional restrictions

CVE-2025-24208 - March 31, 2025

A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack.

A buffer overflow issue was addressed with improved memory handling

CVE-2025-24209 - March 31, 2025

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 18.4, Safari 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Processing maliciously crafted web content may lead to an unexpected process crash.

This issue was addressed with improved handling of floats

CVE-2025-24213 - March 31, 2025

This issue was addressed with improved handling of floats. This issue is fixed in tvOS 18.5, Safari 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, watchOS 11.5, visionOS 2.5. A type confusion issue could lead to memory corruption.

The issue was addressed with improved memory handling

CVE-2025-24216 - March 31, 2025

The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.

The issue was addressed with improved checks

CVE-2025-31192 - March 31, 2025

The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A website may be able to access sensor information without user consent.

This issue was addressed through improved state management

CVE-2025-24167 - March 31, 2025

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A download's origin may be incorrectly associated.

The issue was addressed with improved memory handling

CVE-2025-24264 - March 31, 2025

The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.

The issue was addressed with improved checks

CVE-2025-30467 - March 31, 2025

The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Visiting a malicious website may lead to address bar spoofing.

The issue was addressed with improved memory handling

CVE-2024-54551 - March 21, 2025

The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.6, tvOS 17.6, Safari 17.6, macOS Sonoma 14.6, visionOS 1.3, iOS 17.6 and iPadOS 17.6. Processing web content may lead to a denial-of-service.

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions

CVE-2025-24201 8.8 - High - March 11, 2025

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, Safari 18.3.1, watchOS 11.4, iPadOS 17.7.6, iOS 16.7.11 and iPadOS 16.7.11, iOS 15.8.4 and iPadOS 15.8.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

Memory Corruption

The issue was addressed with improved checks

CVE-2024-44192 5.5 - Medium - March 10, 2025

The issue was addressed with improved checks. This issue is fixed in watchOS 11, macOS Sequoia 15, Safari 18, visionOS 2, iOS 18 and iPadOS 18, tvOS 18. Processing maliciously crafted web content may lead to an unexpected process crash.

A cookie management issue was addressed with improved state management

CVE-2024-54467 6.5 - Medium - March 10, 2025

A cookie management issue was addressed with improved state management. This issue is fixed in watchOS 11, macOS Sequoia 15, Safari 18, visionOS 2, iOS 18 and iPadOS 18, tvOS 18. A malicious website may exfiltrate data cross-origin.

The issue was addressed with improved memory handling

CVE-2024-54658 6.5 - Medium - February 10, 2025

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, Safari 17.4, tvOS 17.4, watchOS 10.4, visionOS 1.1, macOS Sonoma 14.4. Processing web content may lead to a denial-of-service.

An authentication issue was addressed with improved state management

CVE-2024-54542 - January 27, 2025

An authentication issue was addressed with improved state management. This issue is fixed in Safari 18.2, macOS Sequoia 15.2, watchOS 11.2, iOS 18.2 and iPadOS 18.2. Private Browsing tabs may be accessed without authentication.

A logging issue was addressed with improved data redaction

CVE-2025-24169 7.5 - High - January 27, 2025

A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.3, Safari 18.3. A malicious app may be able to bypass browser extension authentication.

The issue was addressed with improved UI

CVE-2025-24113 4.3 - Medium - January 27, 2025

The issue was addressed with improved UI. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. Visiting a malicious website may lead to user interface spoofing.

The issue was addressed by adding additional logic

CVE-2025-24128 4.3 - Medium - January 27, 2025

The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3. Visiting a malicious website may lead to address bar spoofing.

The issue was addressed with improved access restrictions to the file system

CVE-2025-24143 6.5 - Medium - January 27, 2025

The issue was addressed with improved access restrictions to the file system. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. A maliciously crafted webpage may be able to fingerprint the user.

The issue was addressed with improved memory handling

CVE-2025-24158 6.5 - Medium - January 27, 2025

The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing web content may lead to a denial-of-service.

A privacy issue was addressed with improved handling of files

CVE-2025-24150 8.8 - High - January 27, 2025

A privacy issue was addressed with improved handling of files. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3. Copying a URL from Web Inspector may lead to command injection.

Command Injection

The issue was addressed with improved memory handling

CVE-2024-54543 8.8 - High - January 27, 2025

The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.2, tvOS 18.2, Safari 18.2, watchOS 11.2, iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2. Processing maliciously crafted web content may lead to memory corruption.

Memory Corruption

This issue was addressed through improved state management

CVE-2025-24162 6.5 - Medium - January 27, 2025

This issue was addressed through improved state management. This issue is fixed in visionOS 2.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing maliciously crafted web content may lead to an unexpected process crash.

The issue was addressed with improved checks

CVE-2024-27856 7.8 - High - January 15, 2025

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5, iOS 16.7.8 and iPadOS 16.7.8, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, tvOS 17.5, visionOS 1.2. Processing a file may lead to unexpected app termination or arbitrary code execution.

Code Injection

A type confusion issue was addressed with improved memory handling

CVE-2024-54505 8.8 - High - December 12, 2024

A type confusion issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to memory corruption.

Object Type Confusion

The issue was addressed with improved routing of Safari-originated requests

CVE-2024-44246 5.3 - Medium - December 12, 2024

The issue was addressed with improved routing of Safari-originated requests. This issue is fixed in macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, Safari 18.2, iPadOS 17.7.3. On a device with Private Relay enabled, adding a website to the Safari Reading List may reveal the originating IP address to the website.

The issue was addressed with improved checks

CVE-2024-54479 7.5 - High - December 12, 2024

The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash.

The issue was addressed with improved checks

CVE-2024-54502 6.5 - Medium - December 12, 2024

The issue was addressed with improved checks. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash.

The issue was addressed with improved memory handling

CVE-2024-54508 7.5 - High - December 12, 2024

The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash.

A cookie management issue was addressed with improved state management

CVE-2024-44212 5.3 - Medium - December 12, 2024

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1, visionOS 2.1, tvOS 18.1, iOS 18.1 and iPadOS 18.1, watchOS 11.1. Cookies belonging to one origin may be sent to another origin.

Origin Validation Error

The issue was addressed with improved memory handling

CVE-2024-54534 9.8 - Critical - December 12, 2024

The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to memory corruption.

Memory Corruption

Apple Safari and macOS Cookie Management Vulnerability Leading to XSS

CVE-2024-44309 6.1 - Medium - November 20, 2024

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

XSS

Apple Safari Web Content Arbitrary Code Execution

CVE-2024-44308 8.8 - High - November 20, 2024

The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Oracle or by Apple? Click the Watch button to subscribe.

Apple
Vendor

Apple Safari
Product

subscribe