CVE-2025-43526 — Open Redirect in Apple Macos

CWE-601 — Open Redirect6 documents5 sources
Severity
9.8CRITICALNVD
EPSS
0.1%
top 82.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apple MacosApple Safari
Timeline
PublishedDec 17

Description

This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5apple/macos< 26.2
▶NVDapple/macos< 26.2
▶CVEListV5apple/safari< 26.2
▶NVDapple/safari< 26.2

🔴Vulnerability Details

2
GHSA
GHSA-338x-j9c9-2c8v: This issue was addressed with improved URL validation↗2025-12-17
▶
CVEList
CVE-2025-43526: This issue was addressed with improved URL validation↗2025-12-17
▶

📋Vendor Advisories

2
Apple
CVE-2025-43526: Safari 26.2↗2025-12-12
▶
Apple
CVE-2025-43526: macOS Tahoe 26.2↗2025-12-12
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-43526 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-43526 — Open Redirect in Apple Macos | cvebase