CVE-2025-43356

MediumCVSS 6.5

Published: 15/09/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.65%

50th percentile - higher than 50% of all known CVEs

Summary

The issue was addressed with improved handling of caches. The vulnerability affects Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS and watchOS. A website may be able to access sensor information without user consent.

Risk Assessment

Malicious websites may obtain sensor data from the device without the user's knowledge, constituting a privacy violation.

Recommendation

Update the listed systems and Safari to the latest versions containing the fix.

Other vulnerabilities in Safari / WebKit

CVE-2025-43421Medium
Multiple issues were addressed by disabling array allocation sinking. The vulnerability affects Safari, iOS, iPadOS, macOS Tahoe and visionOS. Processing maliciously crafted web content may lead to an unexpected process crash.

Original NVD description (English source)

The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A website may be able to access sensor information without user consent.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS