Cross-Origin Data Exfiltration Vulnerability in Apple Products
CVE-2025-31205

6.5MEDIUM

Key Information:

Vendor

Apple
Status
TV OS
Mac OS
iOS And iPad OS
Visionos
Vendor
CVE Published:
12 May 2025

What is CVE-2025-31205?

A vulnerability exists in multiple Apple platforms that allows a malicious website to potentially exfiltrate sensitive data from user devices through cross-origin requests. This issue was mitigated by implementing enhanced verification checks. Users are encouraged to update their devices to the latest versions: watchOS 11.5, tvOS 18.5, iOS 18.5, iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, and Safari 18.5, to protect against this potential exploit.

Affected Version(s)

iOS and iPadOS < 18.5

macOS < 15.5

Safari < 18.5

References

https://support.apple.com/en-us/122720
https://support.apple.com/en-us/122716
https://support.apple.com/en-us/122404

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.