Product:
tvOS, Safari, iOS, iPadOS, visionOS, watchOS, macOS
Summary
The issue was addressed with improved handling of caches. A website may be able to access sensor information without user consent. This vulnerability affects multiple Apple operating systems and products.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-43356 |
Exploitation
An attacker can exploit this vulnerability by creating a malicious website that, when visited by a user, can access sensitive sensor information without the user’s consent. The attack requires user interaction, as the user must visit the malicious site for the exploit to be successful.
Affected Products
- tvOS 26: Affected by the cache handling issue.
- Safari 26: Vulnerable to unauthorized sensor information access.
- iOS 18.7: Contains the vulnerability that allows sensor data access.
- iPadOS 18.7: Similar vulnerability as iOS 18.7.
- visionOS 26: Affected by the same cache handling issue.
- watchOS 26: Vulnerable to unauthorized access to sensor information.
- macOS Tahoe 26: Contains the vulnerability related to cache handling.
- iOS 26: Vulnerable to unauthorized sensor information access.
- iPadOS 26: Similar vulnerability as iOS 26.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of the affected operating systems. Apple has released updates that address the issue by improving cache handling and preventing unauthorized access to sensor information.