Safari vulnerabilities

170 known vulnerabilities in Safari from Apple. 166 are rated high or critical, and 28 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Safari: Origin Validation Error

  CVE-2025-30466May 29, 2025Apple

  This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. A website may be able to bypass Same Origin Policy.

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-24189May 19, 2025Apple

  The issue was addressed with improved checks. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, watchOS 11.3. Processing maliciously crafted web content may lead to memory corruption.

• 7.3 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-31238May 12, 2025AppleEPSS 1.02%

  The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-31223May 12, 2025Apple

  The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-31204May 12, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

• 8.0 High severity

  Safari: Cross-Site Request Forgery

  CVE-2025-24223May 12, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.

• 8.8 High severity

  iOS and iPadOS: Use After Free

  CVE-2023-42970Apr 11, 2025Apple

  A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari 17. Processing web content may lead to arbitrary code execution.

• 7.3 High severity

  iOS and iPadOS: Improper Control of Generation of Code

  CVE-2023-42875Apr 11, 2025Apple

  Processing web content may lead to arbitrary code execution. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari 17. The issue was addressed with improved memory handling.

• 7.8 High severity

  Safari: Improper Preservation of Permissions

  CVE-2025-31184Mar 31, 2025Apple

  This issue was addressed with improved permissions checking. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. An app may gain unauthorized access to Local Network.

• 9.8 Critical severity

  Safari: Uncontrolled Resource Consumption

  CVE-2025-24264Mar 31, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected

• 7.8 High severity

  Safari: Access of Resource Using Incompatible Type

  CVE-2025-24213Mar 31, 2025Apple

  This issue was addressed with improved handling of floats. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. A type confusion issue could lead to memory corruption.

• 7.0 High severity

  Safari: Buffer Copy without Checking Size of Input

  CVE-2025-24209Mar 31, 2025Apple

  A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected

• 8.1 High severity

  Safari: URL Redirection to Untrusted Site

  CVE-2025-24180Mar 31, 2025AppleEPSS 1.04%

  The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. A malicious website may be able to claim WebAuthn credentials from another website that shares

• 7.5 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2024-54551Mar 21, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing web content may lead to a denial-of-service.

• 10.0 Critical severity

  Apple Multiple Products WebKit Out-of-Bounds Write Exploited

  CVE-2025-24201Mar 11, 2025AppleEPSS 3.85%

  An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3

• 7.5 High severity

  Safari: Insertion of Sensitive Information into Log File

  CVE-2025-24169Jan 27, 2025Apple

  A logging issue was addressed with improved data redaction. This issue is fixed in Safari 18.3, macOS Sequoia 15.3. A malicious app may be able to bypass browser extension authentication.

• 8.8 High severity

  Safari: Improper Neutralization of Special Elements used in a Command

  CVE-2025-24150Jan 27, 2025AppleEPSS 2.94%

  A privacy issue was addressed with improved handling of files. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. Copying a URL from Web Inspector may lead to command injection.

• 8.8 High severity

  Safari: Out-of-bounds Write

  CVE-2024-54543Jan 27, 2025Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corrupt

• 9.1 Critical severity

  Safari: Missing Authorization

  CVE-2024-54542Jan 27, 2025Apple

  An authentication issue was addressed with improved state management. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, watchOS 11.2. Private Browsing tabs may be accessed without authentication.

• 7.8 High severity

  Safari: Improper Control of Generation of Code

  CVE-2024-27856Jan 15, 2025Apple

  The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a file may lead to unexpected app termination or arbi

• 9.8 Critical severity

  Safari: Out-of-bounds Write

  CVE-2024-54534Dec 12, 2024AppleEPSS 1.04%

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corrupt

• 7.5 High severity

  Safari: Out-of-bounds Read

  CVE-2024-54508Dec 12, 2024Apple

  The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected

• 8.8 High severity

  Safari: Access of Resource Using Incompatible Type

  CVE-2024-54505Dec 12, 2024AppleEPSS 1.07%

  A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to m

• 6.3 Medium severity

  Apple Multiple Products Cross-Site Scripting (XSS) Exploited

  CVE-2024-44309Nov 20, 2024AppleEPSS 21.9%

  A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead

• 8.8 High severity

  Apple Multiple Products Code Execution Exploited

  CVE-2024-44308Nov 20, 2024AppleEPSS 9.85%

  The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code executio

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2024-27851Jun 10, 2024Apple

  The issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing maliciously crafted web content may lead to arbitrary code execution.

• 8.8 High severity

  Safari: Integer Overflow or Wraparound

  CVE-2024-27833Jun 10, 2024Apple

  An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2. Processing maliciously crafted web content may lead to arbitrary code executi

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2024-27820Jun 10, 2024AppleEPSS 1.02%

  The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing web content may lead to arbitrary code execu

• 8.8 High severity

  Safari: Access of Memory Location Before Start of Buffer

  CVE-2024-27808Jun 10, 2024AppleEPSS 1.18%

  The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing web content may lead to arbitrary code execution.

• 5.5 Medium severity

  Apple Multiple Products Improper Authentication Exploited

  CVE-2024-27834May 14, 2024AppleEPSS 1.5%

  The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Poi

• 9.6 Critical severity

  Chrome: Use After Free

  CVE-2024-4558May 7, 2024GoogleEPSS 1.53%

  Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

• 8.8 High severity

  Safari: Use After Free

  CVE-2023-42950Mar 28, 2024AppleEPSS 1.07%

  A use after free issue was addressed with improved memory management. This issue is fixed in Safari 17.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2, watchOS 10.2, macOS Sonoma 14.2. Processing maliciously crafted web content may lead to arbitrary code execution.

• 8.6 High severity

  This issue was addressed by removing the vulnerable code.

  CVE-2024-23246Mar 8, 2024Apple

  This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. An app may be able to break out of its sandbox.

• 8.8 High severity

  dav1d: Integer Overflow or Wraparound

  CVE-2024-1580Feb 19, 2024VideoLANEPSS 1.84%

  An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

• 8.8 High severity

  Apple Multiple Products WebKit Type Confusion Exploited

  CVE-2024-23222Jan 23, 2024AppleEPSS 10.6%

  A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, visi

• 8.8 High severity

  Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2024-23213Jan 23, 2024AppleEPSS 1.5%

  The issue was addressed with improved memory handling. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. Processing web content may lead to arbitrary code execution.

• 8.8 High severity

  iOS and iPadOS: Improper Control of Generation of Code

  CVE-2023-42833Jan 10, 2024Apple

  A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and iPadOS 17. Processing web content may lead to arbitrary code execution.

• 9.8 Critical severity

  iOS and iPadOS: Use After Free

  CVE-2023-40414Jan 10, 2024AppleEPSS 1.15%

  A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 10, iOS 17 and iPadOS 17, tvOS 17, macOS Sonoma 14, Safari 17. Processing web content may lead to arbitrary code execution.

• 8.8 High severity

  Safari: Improper Control of Generation of Code

  CVE-2023-42890Dec 12, 2023AppleEPSS 3.21%

  The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2. Processing web content may lead to arbitrary code execution.

• 8.8 High severity

  Apple Multiple Products WebKit Memory Corruption Exploited

  CVE-2023-42917Nov 30, 2023AppleEPSS 9.29%

  A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this is