Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2025-24113: Safari and Apple devices can display fake user interface on malicious sites
CVE-2025-24113 · published 1 year ago
Summary
Safari browsers and Apple operating systems such as iOS, iPadOS, macOS, visionOS and watchOS may show a counterfeit interface when a user visits a crafted webpage. This could trick users into thinking they are interacting with a legitimate page and possibly reveal sensitive information. Updating to the latest versions of Safari and the mentioned Apple operating systems resolves the issue.
What to do
- Update apple safari to version 18.3 or later.
- Update apple ipados to version 18.3 or later.
- Update apple iphone_os to version 18.3 or later.
- Update apple macos to version 15.3 or later.
- Update apple visionos to version 2.3 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apple | safari |
< 18.3 cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* |
| apple | ipados |
< 18.3 cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* |
| apple | iphone_os |
< 18.3 cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
| apple | macos |
< 15.3 cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| apple | visionos |
< 2.3 cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* |
Original advisory text
The issue was addressed with improved UI. This issue is fixed in Safari 18.3, Safari 18.4, iOS 18.3 and iPadOS 18.3, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sequoia 15.4,...
The issue was addressed with improved UI. This issue is fixed in Safari 18.3, Safari 18.4, iOS 18.3 and iPadOS 18.3, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sequoia 15.4, visionOS 2.3, visionOS 2.4, watchOS 11.4. Visiting a malicious website may lead to user interface spoofing.
References
- https://support.apple.com/en-us/122066 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122068 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122073 Release Notes Vendor Advisory
- https://support.apple.com/en-us/122074 Release Notes Vendor Advisory
- http://seclists.org/fulldisclosure/2025/Apr/12
- https://support.apple.com/en-us/122371
- https://support.apple.com/en-us/122372
- https://support.apple.com/en-us/122373
- https://support.apple.com/en-us/122376
- https://support.apple.com/en-us/122378
- https://support.apple.com/en-us/122379
- http://seclists.org/fulldisclosure/2025/Apr/13
- http://seclists.org/fulldisclosure/2025/Apr/2
- http://seclists.org/fulldisclosure/2025/Apr/4
- http://seclists.org/fulldisclosure/2025/Apr/5
- http://seclists.org/fulldisclosure/2025/Apr/8
- http://seclists.org/fulldisclosure/2025/Jan/12
- http://seclists.org/fulldisclosure/2025/Jan/13
- http://seclists.org/fulldisclosure/2025/Jan/15
- http://seclists.org/fulldisclosure/2025/Jan/20
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Timeline
Published27 Jan 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-24113 · NVD
Track software like this
Free during beta