Apple Safari
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Apple Safari.
Recent Apple Safari Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 122719 | Safari 18.5 - Apple Security Content | May 12, 2025 |
| 122379 | Safari 18.4 - Apple Security Content | March 31, 2025 |
| 122285 | Safari 18.3.1 - Apple Security Content | March 11, 2025 |
| 122074 | Safari 18.3 - Apple Security Content | January 27, 2025 |
| 121846 | Safari 18.2 - Apple Security Content | December 11, 2024 |
| 121756 | Safari 18.1.1 - Apple Security Content | November 19, 2024 |
| 121571 | Safari 18.1 - Apple Security Content | October 29, 2024 |
| 121241 | Safari 18 - Apple Security Content | September 16, 2024 |
| HT214121 | Safari 17.6 Security Content | July 29, 2024 |
| HT214103 | Safari 17.5 Security Content | May 13, 2024 |
Known Exploited Apple Safari Vulnerabilities
The following Apple Safari vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Apple Safari Webkit Browser Engine Buffer Overflow Vulnerability |
Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. CVE-2021-30665 Exploit Probability: 0.6% |
November 3, 2021 |
| Apple Safari Webkit Browser Engine Integer Overflow Vulnerability |
Integer overflow. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2021-30663 Exploit Probability: 0.2% |
November 3, 2021 |
By the Year
In 2025 there have been 41 vulnerabilities in Apple Safari with an average score of 6.8 out of ten. Last year, in 2024 Safari had 57 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Safari in 2025 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2025 is greater by 0.00.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 41 | 6.79 |
| 2024 | 57 | 6.79 |
| 2023 | 44 | 7.87 |
| 2022 | 41 | 7.81 |
| 2021 | 35 | 7.66 |
| 2020 | 59 | 7.23 |
| 2019 | 166 | 8.13 |
| 2018 | 41 | 8.11 |
It may take a day or so for new Safari vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apple Safari Security Vulnerabilities
This issue was addressed through improved state management
CVE-2025-30466
- May 29, 2025
This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, visionOS 2.4, macOS Sequoia 15.4. A website may be able to bypass Same Origin Policy.
The issue was addressed with improved checks
CVE-2025-24189
- May 19, 2025
The issue was addressed with improved checks. This issue is fixed in Safari 18.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing maliciously crafted web content may lead to memory corruption.
This issue was addressed with improved memory handling
CVE-2025-31257
- May 12, 2025
This issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
The issue was addressed with improved checks
CVE-2025-31205
- May 12, 2025
The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. A malicious website may exfiltrate data cross-origin.
A type confusion issue was addressed with improved state handling
CVE-2025-31206
- May 12, 2025
A type confusion issue was addressed with improved state handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
The issue was addressed with improved checks
CVE-2025-31215
- May 12, 2025
The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected process crash.
The issue was addressed with improved input validation
CVE-2025-31217
- May 12, 2025
The issue was addressed with improved input validation. This issue is fixed in watchOS 11.5, tvOS 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
The issue was addressed with improved memory handling
CVE-2025-31204
- May 12, 2025
The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.
The issue was addressed with improved memory handling
CVE-2025-24223
- May 12, 2025
The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.
The issue was addressed with improved checks
CVE-2025-31238
- May 12, 2025
The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.
The issue was addressed with improved checks
CVE-2025-31223
- May 12, 2025
The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted web content may lead to memory corruption.
A use-after-free issue was addressed with improved memory management
CVE-2023-42970
- April 11, 2025
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari 17. Processing web content may lead to arbitrary code execution.
Processing web content may lead to arbitrary code execution
CVE-2023-42875
- April 11, 2025
Processing web content may lead to arbitrary code execution. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari 17. The issue was addressed with improved memory handling.
This issue was addressed with improved permissions checking
CVE-2025-31184
- March 31, 2025
This issue was addressed with improved permissions checking. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may gain unauthorized access to Local Network.
The issue was addressed with improved input validation
CVE-2025-24180
- March 31, 2025
The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A malicious website may be able to claim WebAuthn credentials from another website that shares a registrable suffix.
This issue was addressed through improved state management
CVE-2025-30425
- March 31, 2025
This issue was addressed through improved state management. This issue is fixed in tvOS 18.4, Safari 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A malicious website may be able to track users in Safari private browsing mode.
A use-after-free issue was addressed with improved memory management
CVE-2025-30427
- March 31, 2025
A use-after-free issue was addressed with improved memory management. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.
A script imports issue was addressed with improved isolation
CVE-2025-24192
- March 31, 2025
A script imports issue was addressed with improved isolation. This issue is fixed in Safari 18.4, visionOS 2.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Visiting a website may leak sensitive data.
A permissions issue was addressed with additional restrictions
CVE-2025-24208
- March 31, 2025
A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack.
A buffer overflow issue was addressed with improved memory handling
CVE-2025-24209
- March 31, 2025
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 18.4, Safari 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Processing maliciously crafted web content may lead to an unexpected process crash.
This issue was addressed with improved handling of floats
CVE-2025-24213
- March 31, 2025
This issue was addressed with improved handling of floats. This issue is fixed in tvOS 18.5, Safari 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, watchOS 11.5, visionOS 2.5. A type confusion issue could lead to memory corruption.
The issue was addressed with improved memory handling
CVE-2025-24216
- March 31, 2025
The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.
The issue was addressed with improved checks
CVE-2025-31192
- March 31, 2025
The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A website may be able to access sensor information without user consent.
This issue was addressed through improved state management
CVE-2025-24167
- March 31, 2025
This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A download's origin may be incorrectly associated.
The issue was addressed with improved memory handling
CVE-2025-24264
- March 31, 2025
The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.4, tvOS 18.4, iPadOS 17.7.6, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, Safari 18.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.
The issue was addressed with improved checks
CVE-2025-30467
- March 31, 2025
The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. Visiting a malicious website may lead to address bar spoofing.
The issue was addressed with improved memory handling
CVE-2024-54551
- March 21, 2025
The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.6, tvOS 17.6, Safari 17.6, macOS Sonoma 14.6, visionOS 1.3, iOS 17.6 and iPadOS 17.6. Processing web content may lead to a denial-of-service.
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions
CVE-2025-24201
8.8 - High
- March 11, 2025
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in visionOS 2.3.2, iOS 18.3.2 and iPadOS 18.3.2, macOS Sequoia 15.3.2, Safari 18.3.1, watchOS 11.4, iPadOS 17.7.6, iOS 16.7.11 and iPadOS 16.7.11, iOS 15.8.4 and iPadOS 15.8.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).
Memory Corruption
The issue was addressed with improved checks
CVE-2024-44192
5.5 - Medium
- March 10, 2025
The issue was addressed with improved checks. This issue is fixed in watchOS 11, macOS Sequoia 15, Safari 18, visionOS 2, iOS 18 and iPadOS 18, tvOS 18. Processing maliciously crafted web content may lead to an unexpected process crash.
A cookie management issue was addressed with improved state management
CVE-2024-54467
6.5 - Medium
- March 10, 2025
A cookie management issue was addressed with improved state management. This issue is fixed in watchOS 11, macOS Sequoia 15, Safari 18, visionOS 2, iOS 18 and iPadOS 18, tvOS 18. A malicious website may exfiltrate data cross-origin.
The issue was addressed with improved memory handling
CVE-2024-54658
6.5 - Medium
- February 10, 2025
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, Safari 17.4, tvOS 17.4, watchOS 10.4, visionOS 1.1, macOS Sonoma 14.4. Processing web content may lead to a denial-of-service.
An authentication issue was addressed with improved state management
CVE-2024-54542
- January 27, 2025
An authentication issue was addressed with improved state management. This issue is fixed in Safari 18.2, macOS Sequoia 15.2, watchOS 11.2, iOS 18.2 and iPadOS 18.2. Private Browsing tabs may be accessed without authentication.
A logging issue was addressed with improved data redaction
CVE-2025-24169
7.5 - High
- January 27, 2025
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.3, Safari 18.3. A malicious app may be able to bypass browser extension authentication.
The issue was addressed with improved UI
CVE-2025-24113
4.3 - Medium
- January 27, 2025
The issue was addressed with improved UI. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. Visiting a malicious website may lead to user interface spoofing.
The issue was addressed by adding additional logic
CVE-2025-24128
4.3 - Medium
- January 27, 2025
The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3. Visiting a malicious website may lead to address bar spoofing.
The issue was addressed with improved access restrictions to the file system
CVE-2025-24143
6.5 - Medium
- January 27, 2025
The issue was addressed with improved access restrictions to the file system. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, visionOS 2.3. A maliciously crafted webpage may be able to fingerprint the user.
The issue was addressed with improved memory handling
CVE-2025-24158
6.5 - Medium
- January 27, 2025
The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing web content may lead to a denial-of-service.
A privacy issue was addressed with improved handling of files
CVE-2025-24150
8.8 - High
- January 27, 2025
A privacy issue was addressed with improved handling of files. This issue is fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3. Copying a URL from Web Inspector may lead to command injection.
Command Injection
The issue was addressed with improved memory handling
CVE-2024-54543
8.8 - High
- January 27, 2025
The issue was addressed with improved memory handling. This issue is fixed in visionOS 2.2, tvOS 18.2, Safari 18.2, watchOS 11.2, iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2. Processing maliciously crafted web content may lead to memory corruption.
Memory Corruption
This issue was addressed through improved state management
CVE-2025-24162
6.5 - Medium
- January 27, 2025
This issue was addressed through improved state management. This issue is fixed in visionOS 2.3, Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, tvOS 18.3. Processing maliciously crafted web content may lead to an unexpected process crash.
The issue was addressed with improved checks
CVE-2024-27856
7.8 - High
- January 15, 2025
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5, iOS 16.7.8 and iPadOS 16.7.8, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, tvOS 17.5, visionOS 1.2. Processing a file may lead to unexpected app termination or arbitrary code execution.
Code Injection
A type confusion issue was addressed with improved memory handling
CVE-2024-54505
8.8 - High
- December 12, 2024
A type confusion issue was addressed with improved memory handling. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to memory corruption.
Object Type Confusion
The issue was addressed with improved routing of Safari-originated requests
CVE-2024-44246
5.3 - Medium
- December 12, 2024
The issue was addressed with improved routing of Safari-originated requests. This issue is fixed in macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, Safari 18.2, iPadOS 17.7.3. On a device with Private Relay enabled, adding a website to the Safari Reading List may reveal the originating IP address to the website.
The issue was addressed with improved checks
CVE-2024-54479
7.5 - High
- December 12, 2024
The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash.
The issue was addressed with improved checks
CVE-2024-54502
6.5 - Medium
- December 12, 2024
The issue was addressed with improved checks. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash.
The issue was addressed with improved memory handling
CVE-2024-54508
7.5 - High
- December 12, 2024
The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to an unexpected process crash.
A cookie management issue was addressed with improved state management
CVE-2024-44212
5.3 - Medium
- December 12, 2024
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1, visionOS 2.1, tvOS 18.1, iOS 18.1 and iPadOS 18.1, watchOS 11.1. Cookies belonging to one origin may be sent to another origin.
Origin Validation Error
The issue was addressed with improved memory handling
CVE-2024-54534
9.8 - Critical
- December 12, 2024
The issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, Safari 18.2, iOS 18.2 and iPadOS 18.2. Processing maliciously crafted web content may lead to memory corruption.
Memory Corruption
Apple Safari and macOS Cookie Management Vulnerability Leading to XSS
CVE-2024-44309
6.1 - Medium
- November 20, 2024
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
XSS
Apple Safari Web Content Arbitrary Code Execution
CVE-2024-44308
8.8 - High
- November 20, 2024
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Oracle or by Apple? Click the Watch button to subscribe.
