PT-2025-26717 · Apple · Apple Macos

Published 2025-05-12 · Updated 2025-11-23 · CVE-2025-31266

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Safari versions prior to 18.5 macOS Sequoia versions prior to 15.5

Description A flaw allows a website to potentially spoof the domain name displayed in a pop-up window's title bar. This occurs due to improved truncation when displaying the fully qualified domain name.

Recommendations Update Safari to version 18.5. Update macOS Sequoia to version 15.5.

Fix

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

CVE-2025-31266

Affected Products

Apple Macos

References · 10

• https://support.apple.com/en-us/122716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31266 · Security Note
• https://support.apple.com/en-us/122719 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-31266 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31266 · Note
• https://twitter.com/VulmonFeeds/status/1992085440954827169 · Twitter Post
• https://twitter.com/CVEnew/status/1991985312520659330 · Twitter Post
• https://t.me/cveNotify/143700 · Telegram Post
• https://twitter.com/RenwaX23/status/1937471646719230329 · Twitter Post
• https://t.me/CVEtracker/37979 · Telegram Post