Cross-Origin Data Exfiltration in Safari 26.1 (CVE-2025-43480)
CVE-2025-43480 Published on November 4, 2025

The issue was addressed with improved checks. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, Safari 26.1, visionOS 26.1. A malicious website may exfiltrate data cross-origin.

NVD

Vulnerability Analysis

CVE-2025-43480 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

Permissive Cross-domain Policy with Untrusted Domains

The software uses a cross-domain policy file that includes domains that should not be trusted.

Products Associated with CVE-2025-43480

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-43480 are published in these products:

Apple Safari

Apple tvOS

Apple visionOS

Apple watchOS

Apple iOS

Apple iPadOS

Apple macOS

Apple Ios And Ipados

Affected Versions

Apple Safari:

Version unspecified and below 26.1 is affected.

Apple tvOS:

Version unspecified and below 26.1 is affected.

Apple macOS:

Version unspecified and below 26.1 is affected.

Apple visionOS:

Version unspecified and below 26.1 is affected.

Apple watchOS:

Version unspecified and below 26.1 is affected.

Apple iOS and iPadOS:

Version unspecified and below 26.1 is affected.

Exploit Probability

EPSS

0.05%

Percentile

15.31%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.