CVE-2025-43229: Apple Safari XSS Vulnerability

CVE-2025-43229 Overview

CVE-2025-43229 is a universal cross-site scripting (UXSS) vulnerability affecting Apple Safari and macOS Sequoia. Apple addressed the issue through improved state management in Safari 18.6 and macOS Sequoia 15.6. Processing maliciously crafted web content can lead to universal cross-site scripting, allowing an attacker-controlled page to execute script in the context of arbitrary origins. The vulnerability is tracked under CWE-79 and requires user interaction, such as visiting a malicious website. Apple documented the fix in Apple Security Update 124149 and Apple Security Update 124152.

Critical Impact
An attacker who lures a user to a crafted web page can bypass the same-origin policy and execute script in the context of other sites, enabling session theft, credential harvesting, and account takeover.

Affected Products

Apple Safari versions prior to 18.6
Apple macOS Sequoia versions prior to 15.6
WebKit-based browsing components bundled with the affected releases

Discovery Timeline

2025-07-30 - CVE-2025-43229 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43229

Vulnerability Analysis

CVE-2025-43229 is a universal cross-site scripting flaw rooted in incorrect state management within Safari and the WebKit components shipped with macOS Sequoia. Universal XSS differs from traditional reflected or stored XSS because it breaks the browser's same-origin policy rather than exploiting a single vulnerable site. An attacker who controls one page can influence the execution context of unrelated origins loaded by the same browser.

The advisory from Apple confirms the fix involved improved state management, indicating the browser tracked security-relevant state, such as origin, document identity, or navigation context, inconsistently. Attackers can leverage such inconsistencies to smuggle script execution into a document that should be isolated from the attacker page.

The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Successful exploitation grants access to authenticated sessions, cookies accessible to script, and Document Object Model (DOM) content across origins.

Root Cause

The root cause is improper state tracking inside Safari's rendering and navigation pipeline. When the browser fails to associate a document, frame, or script execution context with the correct security origin, script from one origin can operate against another. Apple's remediation replaces the flawed state handling with corrected logic that preserves origin boundaries throughout the affected code paths.

Attack Vector

The attack vector is network-based and requires user interaction. A victim must visit or be redirected to a page hosting the malicious web content. Once loaded, the crafted content triggers the state-management flaw and executes script in the context of a targeted origin. Delivery methods include phishing links, malicious advertisements, watering-hole sites, and compromised third-party resources embedded in trusted pages. Additional technical context is available in the Full Disclosure July 2025 and Full Disclosure August 2025 archives.

No public exploit code, proof of concept, or CISA Known Exploited Vulnerabilities listing is associated with this CVE at publication.

Detection Methods for CVE-2025-43229

Indicators of Compromise

Safari or WebKit process versions below 18.6 and macOS Sequoia builds below 15.6 on managed endpoints
Browser telemetry showing script execution or DOM access spanning unrelated origins within a single tab session
Outbound requests from browser processes to newly registered or low-reputation domains following user navigation to unfamiliar links
Unexpected authentication events on web applications immediately after Safari sessions on unmanaged or personal sites

Detection Strategies

Inventory Safari and macOS versions across the fleet and flag hosts running pre-18.6 Safari or pre-15.6 macOS Sequoia
Correlate web proxy logs with endpoint telemetry to identify Safari sessions that load third-party script from suspicious origins
Hunt for anomalous cookie or token reuse across geographies or devices, which can indicate session theft following a UXSS attack

Monitoring Recommendations

Ensure endpoint agents record browser process launches, child processes, and network destinations for macOS hosts
Forward Safari version data and macOS software update state into the SIEM for continuous compliance reporting
Monitor identity provider logs for token replay or impossible-travel signals following browser activity from unpatched hosts

How to Mitigate CVE-2025-43229

Immediate Actions Required

Upgrade Safari to version 18.6 on all supported macOS releases
Upgrade macOS Sequoia hosts to version 15.6 to receive the bundled WebKit fix
Prioritize patching for users who handle privileged web applications such as email, identity providers, and administrative consoles
Review browser session activity for accounts that used unpatched Safari versions after the July 2025 disclosure

Patch Information

Apple released fixes in Safari 18.6 and macOS Sequoia 15.6. Refer to Apple Security Update 124149 and Apple Security Update 124152 for the full list of addressed issues and installation guidance. Applying the operating system update on macOS Sequoia installs the corrected WebKit components used by Safari and other system web views.

Workarounds

Restrict use of Safari on unpatched macOS hosts and route users to a fully patched browser until the update is deployed
Enforce mobile device management (MDM) policies that require macOS Sequoia 15.6 before allowing access to sensitive web applications
Deploy web content filtering to block known malicious and low-reputation domains that could host crafted payloads
Require phishing-resistant multi-factor authentication to limit the impact of session or credential theft resulting from UXSS

bash

# Verify Safari and macOS versions on a managed host
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Trigger a macOS software update check via MDM or locally
sudo softwareupdate --list
sudo softwareupdate --install --all --restart