Product:
Safari
Summary
This issue was addressed with improved URL validation. Processing maliciously crafted web content may lead to unexpected URL redirection. The issue is fixed in Safari 26, iOS 26 and iPadOS 26.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-31254 |
Exploitation
An attacker can exploit this vulnerability by crafting malicious web content that, when processed by the affected version of Safari, can lead to unexpected URL redirection. This could allow the attacker to redirect users to malicious sites without their consent, potentially leading to further exploitation or data theft.
Affected Products
- Safari: The web browser affected by the URL validation issue.
- iOS: The mobile operating system for iPhone and iPod touch that includes the affected Safari version.
- iPadOS: The operating system for iPad that also includes the affected Safari version.
Mitigation
To mitigate this vulnerability, users should update to the latest versions of Safari, iOS, and iPadOS where the issue has been addressed. Regularly updating software can help protect against known vulnerabilities.