CVE-2025-43502
BaseFortify
Publication date: 2025-11-04
Last updated on: 2026-04-02
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | safari | to 26.1 (exc) |
| apple | ipados | to 26.1 (exc) |
| apple | iphone_os | to 26.1 (exc) |
| apple | visionos | to 26.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a privacy issue where an app may be able to bypass certain Privacy preferences, potentially accessing sensitive data that should be protected. The issue was addressed by removing sensitive data and fixed in iOS 26.1, iPadOS 26.1, Safari 26.1, and visionOS 26.1.
How can this vulnerability impact me? :
This vulnerability could impact you by allowing an app to bypass privacy settings, potentially exposing your sensitive data without your consent or knowledge.
What immediate steps should I take to mitigate this vulnerability?
Update affected devices and software to iOS 26.1, iPadOS 26.1, Safari 26.1, or visionOS 26.1 or later versions where the issue is fixed.