{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-31205", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-03-27T16:13:58.315Z", "datePublished": "2025-05-12T21:42:28.329Z", "dateUpdated": "2026-04-02T18:12:38.723Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "A malicious website may exfiltrate data cross-origin"}]}], "affected": [{"vendor": "Apple", "product": "Safari", "versions": [{"version": "0", "status": "affected", "lessThan": "18.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "0", "status": "affected", "lessThan": "15.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "tvOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"version": "0", "status": "affected", "lessThan": "2.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"version": "0", "status": "affected", "lessThan": "11.5", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. A malicious website may exfiltrate data cross-origin."}], "references": [{"url": "https://support.apple.com/en-us/122404"}, {"url": "https://support.apple.com/en-us/122716"}, {"url": "https://support.apple.com/en-us/122719"}, {"url": "https://support.apple.com/en-us/122720"}, {"url": "https://support.apple.com/en-us/122721"}, {"url": "https://support.apple.com/en-us/122722"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:12:38.723Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-352", "lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-13T15:33:25.751520Z", "id": "CVE-2025-31205", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-13T15:34:09.750Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html"}, {"url": "http://seclists.org/fulldisclosure/2025/May/13"}, {"url": "http://seclists.org/fulldisclosure/2025/May/12"}, {"url": "http://seclists.org/fulldisclosure/2025/May/10"}, {"url": "http://seclists.org/fulldisclosure/2025/May/7"}, {"url": "http://seclists.org/fulldisclosure/2025/May/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:48:36.545Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html"}, {"url": "http://seclists.org/fulldisclosure/2025/May/13"}, {"url": "http://seclists.org/fulldisclosure/2025/May/12"}, {"url": "http://seclists.org/fulldisclosure/2025/May/10"}, {"url": "http://seclists.org/fulldisclosure/2025/May/7"}, {"url": "http://seclists.org/fulldisclosure/2025/May/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:48:36.545Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-31205", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-13T15:33:25.751520Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-13T15:34:06.288Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "tvOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "18.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "15.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "18.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "2.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "11.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "Safari", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "18.5", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/122720"}, {"url": "https://support.apple.com/en-us/122716"}, {"url": "https://support.apple.com/en-us/122404"}, {"url": "https://support.apple.com/en-us/122721"}, {"url": "https://support.apple.com/en-us/122722"}, {"url": "https://support.apple.com/en-us/122719"}], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. A malicious website may exfiltrate data cross-origin."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "A malicious website may exfiltrate data cross-origin"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-05-12T21:42:28.329Z"}}}, "cveMetadata": {"cveId": "CVE-2025-31205", "state": "PUBLISHED", "dateUpdated": "2025-11-03T19:48:36.545Z", "dateReserved": "2025-03-27T16:13:58.315Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-05-12T21:42:28.329Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "matchCriteriaId": "2911F28D-586D-4C43-BCE7-A8A77568E183", "versionEndExcluding": "18.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0459303-7D14-428D-9C4E-2C743AC9529F", "versionEndExcluding": "18.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "AF6AAC00-F384-4B0D-BBA9-C2AD278BF653", "versionEndExcluding": "18.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "EF1B4AB8-2B51-4EED-BD29-C500C83FAB10", "versionEndExcluding": "15.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "matchCriteriaId": "519C8A39-A24E-44B7-B1E8-6EF647FEFCA8", "versionEndExcluding": "18.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*", "matchCriteriaId": "047CDCCE-04BB-4D43-9831-7694992C5CC4", "versionEndExcluding": "2.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "matchCriteriaId": "0CBDEF1C-6D76-4F9D-8433-3AC16F3860F4", "versionEndExcluding": "11.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. A malicious website may exfiltrate data cross-origin."}, {"lang": "es", "value": "El problema se solucion\u00f3 mejorando las comprobaciones. Este problema est\u00e1 corregido en watchOS 11.5, tvOS 18.5, iOS 18.5 y iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5 y Safari 18.5. Un sitio web malicioso podr\u00eda exfiltrar datos de origen cruzado."}], "id": "CVE-2025-31205", "lastModified": "2026-04-02T19:19:47.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2025-05-12T22:15:21.627", "references": [{"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122404"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122716"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122719"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122720"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122721"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/122722"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/May/10"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/May/12"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/May/13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/May/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/May/7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:10364", "cpe": "cpe:/o:redhat:rhel_els:7", "package": "webkitgtk4-0:2.48.3-2.el7_9", "product_name": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "release_date": "2025-07-07T00:00:00Z"}, {"advisory": "RHSA-2025:8046", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "webkit2gtk3-0:2.48.2-1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-05-20T00:00:00Z"}, {"advisory": "RHSA-2025:8530", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "webkit2gtk3-0:2.48.2-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2025-06-04T00:00:00Z"}, {"advisory": "RHSA-2025:8541", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "webkit2gtk3-0:2.48.2-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2025-06-04T00:00:00Z"}, {"advisory": "RHSA-2025:8541", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "webkit2gtk3-0:2.48.2-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2025-06-04T00:00:00Z"}, {"advisory": "RHSA-2025:8541", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "webkit2gtk3-0:2.48.2-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2025-06-04T00:00:00Z"}, {"advisory": "RHSA-2025:8532", "cpe": "cpe:/a:redhat:rhel_tus:8.8", "package": "webkit2gtk3-0:2.48.2-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "release_date": "2025-06-04T00:00:00Z"}, {"advisory": "RHSA-2025:8532", "cpe": "cpe:/a:redhat:rhel_e4s:8.8", "package": "webkit2gtk3-0:2.48.2-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "release_date": "2025-06-04T00:00:00Z"}, {"advisory": "RHSA-2025:7995", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "webkit2gtk3-0:2.48.2-1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-19T00:00:00Z"}, {"advisory": "RHSA-2025:8533", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "webkit2gtk3-0:2.48.2-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-06-04T00:00:00Z"}, {"advisory": "RHSA-2025:8600", "cpe": "cpe:/a:redhat:rhel_e4s:9.2", "package": "webkit2gtk3-0:2.48.2-1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "release_date": "2025-06-05T00:00:00Z"}, {"advisory": "RHSA-2025:8534", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "webkit2gtk3-0:2.48.2-1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-06-04T00:00:00Z"}], "bugzilla": {"description": "webkitgtk: A malicious website may exfiltrate data cross-origin", "id": "2366501", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366501"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-200", "details": ["The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. A malicious website may exfiltrate data cross-origin.", "A flaw was found in WebKitGTK. A malicious website may steal data cross-origin due to improper security checks within the web browser or rendering engine, leading to unauthorized disclosure of information."], "mitigation": {"lang": "en:us", "value": "Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.\nIn Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.\nThis vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.\nTo mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.\nAdditionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality."}, "name": "CVE-2025-31205", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "webkitgtk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "webkitgtk3", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2025-05-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-31205\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-31205\nhttps://webkitgtk.org/security/WSA-2025-0004.html"], "statement": "To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.", "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-28T01:55:59.392353+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest Apple releases that contain the WebKitGTK fix: Safari\u202f18.5 or later, iOS\u202f18.5 or later, iPadOS\u202f18.5 or later, macOS\u202fSequoia\u202f15.5 or later, tvOS\u202f18.5 or later, visionOS\u202f2.5 or later, and watchOS\u202f11.5 or later.\n\nIf an immediate OS or browser upgrade is not possible, configure cross\u2011origin policies in web content\u2014such as setting origin\u2011agent\u2011clone or strict content\u2011security\u2011policy headers\u2014to restrict data leakage from untrusted sites.\n\nMonitor outbound traffic on client devices for unusual cross\u2011origin requests to known malicious domains, and apply network controls or alerts to block or flag such activity."], "summary": {"action": "Patch Immediately", "impact": "Data Exfiltration via Cross\u2011Origin Leakage"}, "threat_synthesis": {"affected_systems": "Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are impacted. Fixed versions are Safari\u202f18.5, iOS\u202f18.5, iPadOS\u202f18.5, macOS\u202fSequoia\u202f15.5, tvOS\u202f18.5, visionOS\u202f2.5, and watchOS\u202f11.5. Red\u2011Hat Enterprise Linux distributions (RHEL\u202f8/9 and derivatives) that ship the WebKitGTK engine may also be affected, as the component is listed in the CPE set and could contain the vulnerable code.", "description_and_impact": "A malicious website can exfiltrate data across origins, leaking any information that a web page can access. The flaw is client\u2011side and does not lead to code execution but violates confidentiality by allowing data to be sent to an external domain. The weakness aligns with CWE\u2011200 and has been mitigated by stricter origin checks in the fixed releases.", "risk_and_exploitability": "The CVSS score of 6.5 places the issue in the medium severity range, while the EPSS score of less than 1\u202f% indicates a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user visiting a crafted website or an application embedding WebKitGTK to load a malicious resource; once the page is rendered, the attacker can retrieve confidential data. No privilege escalation is required and the impact is limited to confidentiality, though the core nature of the flaw means any application using the affected engine could be exposed."}}}}, "created": "2026-04-28T02:00:15.399604+00:00", "updated": "2026-04-28T02:00:15.399622+00:00", "vendors": []}