The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26, iOS 18.7 and iPadOS 18.7. A website may be able to access sensor information without user consent.
References
| Link | Resource |
|---|---|
| https://support.apple.com/en-us/125108 | Release Notes Vendor Advisory |
| https://support.apple.com/en-us/125109 | Release Notes Vendor Advisory |
| https://support.apple.com/en-us/125113 | Release Notes Vendor Advisory |
| https://support.apple.com/en-us/125114 | Release Notes Vendor Advisory |
| https://support.apple.com/en-us/125115 | Release Notes Vendor Advisory |
| https://support.apple.com/en-us/125116 | Release Notes Vendor Advisory |
| http://seclists.org/fulldisclosure/2025/Sep/49 | |
| http://seclists.org/fulldisclosure/2025/Sep/53 | |
| http://seclists.org/fulldisclosure/2025/Sep/56 | |
| http://seclists.org/fulldisclosure/2025/Sep/57 | |
| http://seclists.org/fulldisclosure/2025/Sep/59 | |
| http://www.openwall.com/lists/oss-security/2025/09/22/3 |
Configurations
Configuration 1 (hide)
|
History
04 Nov 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26, iOS 18.7 and iPadOS 18.7. A website may be able to access sensor information without user consent. | |
| References |
|
|
Information
Published : 2025-09-15 23:15
Updated : 2025-11-04 22:16
NVD link : CVE-2025-43356
Mitre link : CVE-2025-43356
CVE.ORG link : CVE-2025-43356
JSON object : View
Products Affected
apple
- watchos
- visionos
- ipados
- iphone_os
- safari
- tvos
- macos
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor