Improper URL Validation in macOS and Safari by Apple
CVE-2025-43526

9.8CRITICAL

Key Information:

Vendor

Apple
Status
Safari
Mac OS
Vendor
CVE Published:
17 December 2025

What is CVE-2025-43526?

An issue in Apple’s macOS and Safari was discovered where, under specific conditions, web content accessed through a file URL in Lockdown Mode could exploit Web APIs that are intended to be restricted. This vulnerability was mitigated through enhanced URL validation in the latest versions of both macOS Tahoe and Safari, specifically version 26.2. Users are urged to update to these versions to safeguard against potential exploitation.

Affected Version(s)

macOS < 26.2

Safari < 26.2

References

https://support.apple.com/en-us/125892
https://support.apple.com/en-us/125886

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-43526 : Improper URL Validation in macOS and Safari by Apple