Description
This issue was addressed through improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. Processing maliciously crafted web content may lead to universal cross site scripting.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apple | Safari | < 18 | 18 |
| Apple | iOS and iPadOS | < 18 | 18 |
| Apple | macOS | < 15 | 15 |
| Apple | tvOS | < 18 | 18 |
| Apple | visionOS | < 2 | 2 |
| Apple | watchOS | < 11 | 11 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | webkitgtk4 +3 | 2.46.6-1.amzn2.0.2 | ALAS2-2025-2869 |
Advisories 7
- ALAS2-2025-2869 Important: webkitgtk4 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 23, 2026
- WID-SEC-2024-2153 Apple iOS und iPadOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 24, 2025
- WID-SEC-2024-2154 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 11, 2025
- NCSC-2024-0457 Kwetsbaarheden verholpen in Apple iOS en iPadOS NCSC-NL (Netherlands) · Nov 20, 2024
- WID-SEC-2024-2155 Apple Safari: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 28, 2024
- NCSC-2024-0382 Kwetsbaarheden verholpen in Apple iOS en iPadOS NCSC-NL (Netherlands) · Sep 26, 2024
- NCSC-2024-0381 Kwetsbaarheden verholpen in Apple MacOS NCSC-NL (Netherlands) · Sep 26, 2024