CVE-2025-31205

Root

Cause

CVE-2025-31205 is a cross-origin data exfiltration vulnerability in WebKit, the browser engine used by Safari. The issue was present in Safari 18.4 and earlier versions on affected platforms, where insufficient checks allowed a malicious website to bypass same-origin policy restrictions [1][2].

Exploitation

The vulnerability is triggered by simply visiting a malicious website in an affected version of Safari. No user interaction beyond standard browsing is required; the attacker-controlled site can execute crafted web content to leak data from other origins [1]. Apple's advisory describes the fix as "improved checks" but does not disclose further technical details [2].

Impact

Successful exploitation enables a malicious website to exfiltrate data cross-origin, potentially exposing sensitive information such as authentication tokens, cookies, or other site-specific data that should be isolated. The CVSS v3 score of 6.5 reflects medium severity with a network attack vector and low attack complexity [1].

Mitigation

Apple released patches on May 12, 2025, in Safari 18.5, iOS/iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, and watchOS 11.5 [1][2][3][4]. Users should update their devices immediately. No workarounds were provided.