CVE-2025-30466

CRITICAL

Safari <18.4 - Open Redirect

Title source: llm

Description

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, visionOS 2.4, macOS Sequoia 15.4. A website may be able to bypass Same Origin Policy.

References (4)

Scores

CVSS v3 9.8
EPSS 0.0006
EPSS Percentile 16.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-346
Status published

Affected Products (5)

apple/safari < 18.4
apple/ipados < 18.4
apple/iphone_os < 18.4
apple/macos < 15.4
apple/visionos < 2.4

Timeline

Published May 29, 2025
Tracked Since Feb 18, 2026