CVE-2025-43493: Apple Safari Auth Bypass Vulnerability

CVE-2025-43493 Overview

CVE-2025-43493 is an address bar spoofing vulnerability affecting Apple Safari, iOS, iPadOS, macOS, and visionOS. A malicious website can manipulate the browser's address bar to display a URL different from the actual origin serving the content. The flaw is categorized under CWE-290: Authentication Bypass by Spoofing and requires user interaction to exploit. Apple addressed the issue with improved checks in Safari 26.1, iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, and visionOS 26.1.

Critical Impact
Attackers can trick users into trusting phishing pages by displaying a legitimate-looking URL in the Safari address bar while serving attacker-controlled content.

Affected Products

Apple Safari (prior to 26.1)
Apple iOS and iPadOS (prior to 18.7.2 and 26.1)
Apple macOS Tahoe (prior to 26.1) and visionOS (prior to 26.1)

Discovery Timeline

2025-11-04 - CVE-2025-43493 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43493

Vulnerability Analysis

The vulnerability allows a malicious website to spoof the URL shown in Safari's address bar. When a user visits an attacker-controlled page, the browser can be manipulated into rendering a trusted URL string while continuing to display content from a different origin. This undermines the browser's primary trust indicator that users rely on to verify site identity.

Address bar spoofing weakens phishing defenses because security awareness training typically instructs users to verify the URL before entering credentials. When that indicator is unreliable, attackers can host convincing replicas of banking, enterprise SSO, or webmail portals while appearing to originate from the legitimate domain.

The issue impacts confidentiality and integrity indirectly by enabling credential harvesting and social engineering. It does not permit direct code execution or data disclosure without user interaction.

Root Cause

Apple's advisory states the issue was addressed with improved checks, indicating the underlying cause was insufficient validation of the origin displayed in the address bar during specific navigation or rendering sequences. WebKit failed to reconcile the displayed URL with the actual document origin under certain conditions.

Attack Vector

Exploitation is network-based and requires the victim to visit a malicious website. No authentication or elevated privileges are required. The attacker crafts a page that triggers the spoofing condition, then presents forged content beneath a trusted-looking URL. See the Apple Security Advisory 125632 for the vendor's technical summary.

No public proof-of-concept or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-43493

Indicators of Compromise

Safari or WebKit-based browser versions running builds earlier than Safari 26.1, iOS/iPadOS 18.7.2 or 26.1, macOS Tahoe 26.1, or visionOS 26.1.
User reports of credential entry on pages that appeared legitimate but resulted in account compromise.
Outbound HTTP/HTTPS connections from Apple devices to newly registered or low-reputation domains preceding suspicious authentication events.

Detection Strategies

Inventory Apple endpoints and mobile devices to identify unpatched Safari, iOS, iPadOS, macOS, and visionOS versions.
Correlate proxy and DNS telemetry with threat intelligence feeds to identify phishing infrastructure targeting Apple users.
Monitor identity provider logs for authentication anomalies such as impossible travel or unusual client fingerprints following user web browsing.

Monitoring Recommendations

Ingest browser version telemetry from managed Apple devices into a centralized data lake to enforce patch compliance.
Alert on repeated failed logins or MFA challenges that follow visits to unusual external domains.
Track user reports of suspicious URLs through phishing report workflows and cross-reference with device patch status.

How to Mitigate CVE-2025-43493

Immediate Actions Required

Update Safari to version 26.1 on macOS systems that support the standalone update.
Upgrade iOS and iPadOS devices to 18.7.2 or 26.1, macOS to Tahoe 26.1, and visionOS to 26.1.
Reinforce user awareness that address bar contents can be manipulated and that MFA remains the strongest defense against credential theft.

Patch Information

Apple released fixes across multiple platforms on 2025-11-04. Reference the vendor advisories for exact build numbers: Apple Security Advisory 125632, Apple Security Advisory 125633, Apple Security Advisory 125634, Apple Security Advisory 125638, and Apple Security Advisory 125640.

Workarounds

Enforce mobile device management (MDM) policies that block installation of updates beyond the patched baseline and require prompt installation of security updates.
Deploy phishing-resistant authentication such as WebAuthn or platform passkeys so that address bar spoofing alone cannot yield credential compromise.
Route corporate browsing through a secure web gateway that inspects and blocks known phishing domains regardless of the displayed URL.

bash

# Verify Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Query iOS/iPadOS version via MDM (example: Jamf)
jamf recon | grep -i "OS Version"