CVE-2025-30467: Apple Safari Address Bar Spoofing Flaw

CVE-2025-30467 Overview

CVE-2025-30467 is an address bar spoofing vulnerability affecting Apple Safari and multiple Apple operating systems. The flaw allows a malicious website to manipulate the browser's URL display, misleading users about the origin of the content they are viewing. Apple addressed the issue with improved checks in Safari 18.4, iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, and watchOS 11.4. The vulnerability is categorized as User Interface (UI) Misrepresentation of Critical Information [CWE-451] and requires user interaction to exploit. Successful exploitation supports phishing campaigns by making fraudulent pages appear to originate from trusted domains.

Critical Impact
Visiting a crafted website can cause Safari to display an incorrect URL in the address bar, enabling convincing phishing attacks against users of unpatched Apple devices.

Affected Products

Apple Safari prior to 18.4
Apple iOS and iPadOS prior to 18.4
Apple macOS Sequoia prior to 15.4 and Apple watchOS prior to 11.4

Discovery Timeline

2025-03-31 - CVE-2025-30467 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30467

Vulnerability Analysis

The vulnerability resides in Safari's handling of URL rendering within the browser's address bar. When a user visits a malicious website, the site can trigger conditions that cause the address bar to display a URL different from the actual origin of the loaded content. This class of flaw falls under UI spoofing, where the security-critical origin indicator no longer reflects the true document being rendered.

Apple's advisory states the issue was resolved through improved checks, which indicates the fix strengthens validation logic that governs when and how the displayed URL is updated during navigation events. The vulnerability requires user interaction, meaning a victim must load the attacker-controlled page for exploitation to succeed.

Root Cause

The root cause is insufficient validation between the browser's navigation state and the URL rendered in the address bar. Race conditions or unchecked navigation transitions can leave the visible URL out of sync with the actual document origin, producing the spoof.

Attack Vector

Exploitation occurs over the network. An attacker hosts a crafted page and lures the victim to visit it through phishing email, malicious advertisement, or a compromised site. Once loaded, the page uses navigation techniques to place a trusted-looking URL in the address bar while displaying attacker-controlled content, capturing credentials or delivering additional payloads.

No verified proof-of-concept code is publicly available. Refer to the Apple Security Advisory #122371 and the Full Disclosure Mailing List Post for additional technical detail.

Detection Methods for CVE-2025-30467

Indicators of Compromise

Web proxy or DNS logs showing user navigation to newly registered or low-reputation domains followed by credential submissions to unrelated services.
Endpoint telemetry recording Safari process activity loading suspicious HTML pages that trigger multiple rapid navigation events.
User reports of address bars displaying legitimate-looking URLs while page content or certificate details do not match.

Detection Strategies

Inventory Safari, iOS, iPadOS, macOS, and watchOS versions across managed devices and flag hosts running versions earlier than Safari 18.4, iOS 18.4, iPadOS 18.4, macOS 15.4, or watchOS 11.4.
Correlate phishing report tickets with browser version data to prioritize users on vulnerable builds.
Deploy web filtering to block domains associated with active phishing campaigns leveraging address bar spoofing techniques.

Monitoring Recommendations

Monitor MDM compliance dashboards for devices that have not applied the March 2025 Apple security updates.
Track authentication anomalies such as logins from new geolocations shortly after users click links in email, which can indicate successful phishing following a spoofed URL.
Review browser crash and navigation logs on managed macOS endpoints for repeated cross-origin navigation patterns.

How to Mitigate CVE-2025-30467

Immediate Actions Required

Update Safari to version 18.4 and upgrade Apple devices to iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, or watchOS 11.4.
Enforce automatic OS and Safari updates through mobile device management (MDM) profiles for all corporate Apple endpoints.
Communicate phishing awareness reminders to users, emphasizing verification of certificate details and page content, not only the visible URL.

Patch Information

Apple released fixes across multiple platforms. Reference the vendor advisories for build details: Apple Security Advisory #122371, Apple Security Advisory #122373, Apple Security Advisory #122376, and Apple Security Advisory #122379. The fix implements improved checks that validate the address bar contents against the actual navigation state.

Workarounds

Restrict Safari usage for high-risk workflows such as administrative logins until patches are applied.
Deploy enterprise web filtering and DNS-layer protection to block known phishing domains that could weaponize this spoof.
Direct users to alternative patched browsers on unmanaged devices where the Apple update cannot be immediately installed.

bash

# Verify installed Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Query current macOS build to confirm 15.4 or later
sw_vers -productVersion