CVE-2025-31266

A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/122716	Release Notes Vendor Advisory
https://support.apple.com/en-us/122719	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:o:apple:macos::::::::

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se abordó un problema de suplantación con una truncación mejorada al mostrar el nombre de dominio completo. Este problema está corregido en Safari 18.5, macOS Sequoia 15.5. Un sitio web podría suplantar el nombre de dominio en el título de una ventana emergente.

Information

Published : 2025-11-21 22:16

Updated : 2026-10-18 20:10

NVD link : CVE-2025-31266

Mitre link : CVE-2025-31266

CVE.ORG link : CVE-2025-31266

JSON object : View

Products Affected

apple

macos
safari

CWE

CWE-451

User Interface (UI) Misrepresentation of Critical Information

{"id": "CVE-2025-31266", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-31266", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-23T11:32:06.781892Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "product-security@apple.com", "affectedData": [{"vendor": "Apple", "product": "Safari", "versions": [{"status": "affected", "version": "0", "lessThan": "18.5", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "0", "lessThan": "15.5", "versionType": "custom"}]}]}], "published": "2025-11-21T22:16:19.743", "references": [{"url": "https://support.apple.com/en-us/122716", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/122719", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-451"}]}], "descriptions": [{"lang": "en", "value": "A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window."}, {"lang": "es", "value": "Se abord\u00f3 un problema de suplantaci\u00f3n con una truncaci\u00f3n mejorada al mostrar el nombre de dominio completo. Este problema est\u00e1 corregido en Safari 18.5, macOS Sequoia 15.5. Un sitio web podr\u00eda suplantar el nombre de dominio en el t\u00edtulo de una ventana emergente."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2911F28D-586D-4C43-BCE7-A8A77568E183", "versionEndExcluding": "18.5"}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF1B4AB8-2B51-4EED-BD29-C500C83FAB10", "versionEndExcluding": "15.5"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}