CVE-2025-43392: Apple Safari Information Disclosure Flaw

CVE-2025-43392 Overview

CVE-2025-43392 is a cross-origin information disclosure vulnerability affecting Apple Safari and multiple Apple operating systems. The flaw stems from improper handling of caches, allowing a malicious website to exfiltrate image data across origin boundaries. This breaks the same-origin policy that browsers rely on to isolate content from different websites. Apple addressed the issue with improved cache handling in Safari 26.1, iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1. The vulnerability is categorized under [CWE-942] (Permissive Cross-domain Policy with Untrusted Domains) and requires user interaction, such as visiting a crafted webpage.

Critical Impact
A malicious website can read image data from cross-origin resources, breaking browser same-origin isolation and exposing potentially sensitive image content loaded from other domains.

Affected Products

Apple Safari (versions prior to 26.1)
Apple iOS and iPadOS (prior to 18.7.2 and 26.1)
Apple macOS Tahoe, tvOS, visionOS, and watchOS (prior to 26.1)

Discovery Timeline

2025-11-04 - CVE-2025-43392 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43392

Vulnerability Analysis

CVE-2025-43392 is an information disclosure vulnerability rooted in how Safari's WebKit engine caches image resources. Browsers enforce the same-origin policy to prevent a page on one origin from reading pixel data of images hosted on another origin. When cross-origin image handling in the cache layer does not correctly track or enforce origin metadata, a page can obtain access to image bytes it should not be able to read. This class of flaw is tracked as [CWE-942] and enables cross-origin data leakage without requiring code execution.

Exploitation requires the victim to load an attacker-controlled webpage. Once loaded, the page can trigger the vulnerable cache path against a targeted cross-origin image resource and read the returned data. Because the flaw operates entirely inside the browser, no privileges are needed beyond the ability to serve HTML and JavaScript to the victim.

The EPSS probability for this issue is 0.46%, reflecting a low but non-zero likelihood of exploitation activity.

Root Cause

The root cause is incorrect handling of cached image data across origin boundaries within WebKit. Apple's advisory states the fix addresses the issue "with improved handling of caches," indicating that cached image entries were accessible in contexts that should have been isolated by origin. This allows a page to bypass the cross-origin read restriction on <img> and related image resources.

Attack Vector

The attack vector is network-based. An adversary hosts a crafted webpage and lures the victim to visit it, satisfying the required user interaction. The page then references a targeted cross-origin image URL that the victim's browser has cached or will fetch, and abuses the cache logic to read image content the same-origin policy would normally block. No authentication is required. The impact is confidentiality only, with no direct effect on integrity or availability.

See the Apple Support Advisory #125632 and related advisories for platform-specific technical details.

Detection Methods for CVE-2025-43392

Indicators of Compromise

Safari or WebKit-based browser sessions on Apple devices running versions prior to Safari 26.1, iOS/iPadOS 18.7.2, or the 26.1 release train.
Outbound requests from browsers to untrusted domains that subsequently issue repeated cross-origin image fetches to sensitive internal or third-party domains.
Web server logs showing unusual image resource access patterns originating from referrers on unrelated origins.

Detection Strategies

Inventory Apple endpoints and enumerate installed Safari and OS versions to identify unpatched devices exposed to cross-origin image data exfiltration.
Monitor web proxy and DNS telemetry for user visits to newly registered or low-reputation domains that load high volumes of cross-origin image content.
Correlate browser version telemetry with visits to sensitive internal web applications that render user-specific images (avatars, document previews, dashboards).

Monitoring Recommendations

Enable browser and OS version reporting through MDM to continuously track patch status across the Apple fleet.
Log and review HTTP Referer and Origin headers on internal applications that serve sensitive image content.
Alert on anomalous spikes in cross-origin image requests targeting authenticated endpoints.

How to Mitigate CVE-2025-43392

Immediate Actions Required

Update all Apple devices to Safari 26.1, iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, or watchOS 26.1.
Prioritize patching endpoints that access sensitive internal web applications rendering user-specific or confidential images.
Enforce update compliance through MDM policies and block non-compliant devices from sensitive resources until remediation completes.

Patch Information

Apple released fixes across its product line in the 26.1 update wave and iOS/iPadOS 18.7.2. Consult the vendor advisories for exact build numbers and platform coverage: Apple Support Advisory #125632, #125633, #125634, #125637, #125638, #125639, and #125640.

Workarounds

Restrict browsing on unpatched Apple devices to trusted, business-required domains using web filtering or DNS controls.
Serve sensitive images with strict Cross-Origin-Resource-Policy: same-origin and Cross-Origin-Embedder-Policy headers to reduce cross-origin reachability.
Require authenticated sessions and short-lived signed URLs for sensitive image assets so cached content cannot be reused by attacker pages.

bash

# Example response headers to harden sensitive image endpoints
Cross-Origin-Resource-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cache-Control: private, no-store