CVE-2025-43356: Apple Safari Information Disclosure Flaw

CVE-2025-43356 Overview

CVE-2025-43356 is an information disclosure vulnerability affecting Apple Safari and multiple Apple operating systems. The flaw stems from improper handling of caches, allowing a malicious website to access sensor information without user consent. Apple addressed the issue with improved cache handling in Safari 26, iOS 18.7, iPadOS 18.7, iOS 26, iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26. The vulnerability is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor) and requires user interaction, such as visiting a crafted webpage, to be exploited.

Critical Impact
A malicious website can silently read device sensor telemetry (such as motion or orientation data) without prompting the user, enabling privacy-invasive fingerprinting and side-channel inference attacks.

Affected Products

Apple Safari (prior to Safari 26)
Apple iOS and iPadOS (prior to 18.7 and 26)
Apple macOS Tahoe (prior to 26), tvOS 26, visionOS 26, and watchOS 26

Discovery Timeline

2025-09-15 - CVE-2025-43356 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-43356

Vulnerability Analysis

The vulnerability resides in how Safari and the underlying WebKit engine cache sensor-related data across browsing contexts. When a webpage requests access to device sensors, the browser is expected to enforce a user-consent boundary before returning readings from motion, orientation, or environmental sensors. Improper cache management allowed sensor data to remain accessible in a way that bypassed the consent gate.

The issue is network-reachable through any web content the victim renders. Successful exploitation exposes confidential sensor telemetry but does not modify system integrity or availability. Attackers can weaponize the leaked data for device fingerprinting, cross-site tracking, keystroke inference from motion sensors, or approximate geolocation from environmental readings.

Root Cause

The root cause is inadequate isolation of cached sensor state within the browser. Sensor readings that should have been gated by explicit user permission were retrievable through cached pathways, violating the least-privilege model enforced by the WebKit permissions framework. Apple's advisories describe the remediation as "improved handling of caches," indicating the fix invalidates or partitions sensor data caches to prevent unauthorized reads.

Attack Vector

An attacker hosts or compromises a website and lures a target into visiting it using standard phishing, malvertising, or watering-hole techniques. Once the page loads in a vulnerable Safari version, embedded JavaScript queries sensor interfaces such as DeviceMotionEvent or DeviceOrientationEvent and retrieves data from the cache without triggering the consent prompt. No authentication or elevated privileges are required. Full technical details are documented in the Apple Support Advisory for Safari 26 and related platform advisories.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-43356

Indicators of Compromise

Browser telemetry showing calls to DeviceMotionEvent, DeviceOrientationEvent, or ambient light sensor APIs from origins the user did not explicitly authorize.
Outbound HTTP/HTTPS traffic to known fingerprinting or tracking domains immediately following visits to unfamiliar sites on unpatched Safari builds.
Web server logs on defensive proxies showing JavaScript payloads that repeatedly poll sensor endpoints without a preceding permission request.

Detection Strategies

Inventory endpoints running Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS builds older than the fixed versions listed in Apple's advisories.
Deploy web content inspection or DNS filtering to flag pages that reference sensor APIs alongside known tracker infrastructure.
Correlate browser process activity with unusual JavaScript execution patterns using EDR telemetry on macOS and iOS management platforms.

Monitoring Recommendations

Track Apple software version compliance through MDM and alert on devices that fall behind the patched builds (Safari 26, iOS/iPadOS 18.7 and 26, macOS Tahoe 26).
Monitor mobile threat defense tooling for anomalous sensor API invocation from web content.
Review network egress logs for signs of automated sensor-data exfiltration to third-party analytics or attacker-controlled domains.

How to Mitigate CVE-2025-43356

Immediate Actions Required

Update Safari to version 26 and Apple operating systems to iOS 18.7, iPadOS 18.7, iOS 26, iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, or watchOS 26.
Push the updates through MDM to enforce compliance across managed fleets and treat unpatched devices as non-compliant.
Educate users to avoid untrusted links and prefer navigation to known-good bookmarks until patches are fully deployed.

Patch Information

Apple has released fixes across all affected platforms. Refer to the vendor guidance: Apple Support Advisory #125108, #125109, #125110, #125113, #125114, #125115, and #125116. Community disclosure discussion is available on the Full Disclosure mailing list and the oss-security list.

Workarounds

Disable Motion & Orientation Access in Safari settings under Settings > Safari > Advanced > Website Data and related privacy controls until patches are applied.
Use MDM configuration profiles to restrict Safari's access to device motion and orientation APIs on managed iOS and iPadOS devices.
Route browser traffic through enterprise web gateways that strip or block sensor-oriented JavaScript from untrusted origins.

bash

# Verify Safari version on macOS
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Verify iOS/iPadOS build version via MDM query (example: jamf)
jamf recon | grep -i "OS Version"

# Recommended minimum versions:
#   Safari      >= 26
#   iOS/iPadOS  >= 18.7  (or 26)
#   macOS Tahoe >= 26
#   tvOS        >= 26
#   visionOS    >= 26
#   watchOS     >= 26