CVE-2025-24128

CVE-2025-24128 is an address bar spoofing vulnerability affecting Safari. The issue stems from a logic flaw in how the browser handles certain website requests, allowing a malicious site to manipulate the displayed URL in the address bar. Apple addressed the issue by adding additional logic to properly validate and present the correct URL [1].

Exploitation requires tricking the user into visiting a specially crafted malicious website. No other authentication or local network access is needed, making the attack surface broadly accessible through web browsing. The prerequisite is solely user interaction to navigate to the attacker-controlled site [2].

If successfully exploited, an attacker can make the address bar show a legitimate or trusted domain while the actual page content is malicious. This spoofing enables more effective phishing or social engineering attacks, as users may trust the displayed URL and divulge sensitive information [3].

Apple released fixes on January 27, 2025, in Safari 18.3, iOS 18.3 and iPadOS 18.3, and macOS Sequoia 15.3. Users are advised to update their devices to these versions to mitigate the vulnerability [1][3].