CVE-2025-43502CWE-284broken-access-control

CVE-2025-43502

High · published November 4, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

⚡ A sneaky app might just slip around your privacy preferences! A privacy issue was addressed in Safari and other Apple platforms. 🔒 Think of your privacy settings as a bouncer at an exclusive club. If an app can bypass these preferences, it's like letting a party-crasher into the VIP section without a proper ID — highly concerning! This vulnerability could allow an app to access sensitive data that should be off-limits, potentially exposing your personal information to nefarious parties. In a world where privacy is paramount, this could lead to identity theft or unwanted surveillance. Imagine the fallout if your private moments were just a click away for anyone!

Put simply

Think of your privacy settings as a bouncer at an exclusive club. If an app can bypass these preferences, it's like letting a party-crasher into the VIP section without a proper ID — highly concerning! The vulnerability arises from the app's ability to bypass certain privacy preferences, exposing sensitive data that users expect to be protected. This breach could unintentionally leak personal information, undermining user trust.

What to do

This vulnerability could allow an app to access sensitive data that should be off-limits, potentially exposing your personal information to nefarious parties. In a world where privacy is paramount, this could lead to identity theft or unwanted surveillance. Imagine the fallout if your private moments were just a click away for anyone! Update to Safari 26.1, iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, or visionOS 26.1 to close this loophole. Regularly review app permissions and privacy settings to keep your data safe! You've got this! Stay vigilant and keep your devices updated to maintain your privacy fortress! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00472 · 39.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-11-04T07:15Z
Affected products (4)
ProductVersionsFixed in
apple/safari< 26.126.1
apple/ipados< 26.126.1
apple/iphone_os< 26.126.1
apple/visionos< 26.126.1
References (4)
EPSS history
Timeline
  • 04 NOV 01:17Z
    A privacy issue was addressed by removing sensitive data
    cvelistv5