CVE-2025-46277
📋 TL;DR
A macOS, iOS, iPadOS, and watchOS vulnerability allows applications to access a user's Safari browsing history due to insufficient data redaction in logging. This affects users running vulnerable versions of these Apple operating systems. The issue could expose sensitive browsing information to malicious applications.
💻 Affected Systems
- macOS
- iOS
- iPadOS
- watchOS
📦 What is this software?
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Watchos by Apple
⚠️ Risk & Real-World Impact
Worst Case
Malicious app collects complete Safari browsing history including sensitive sites (banking, healthcare, private communications) leading to privacy violation, blackmail, or targeted attacks.
Likely Case
Malicious app collects browsing history for advertising profiling, data harvesting, or limited privacy invasion.
If Mitigated
No impact if patched; limited impact if user only installs trusted apps from official App Store.
🎯 Exploit Status
Requires malicious app installation and execution. No public exploit details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Tahoe 26.2, iOS 26.2, iPadOS 26.2, watchOS 26.2
Vendor Advisory: https://support.apple.com/en-us/125884
Restart Required: Yes
Instructions:
1. Open Settings/System Preferences. 2. Go to General > Software Update. 3. Install available updates for your device. 4. Restart device when prompted.
🔧 Temporary Workarounds
Restrict App Installation
allOnly install apps from official App Store to reduce risk of malicious apps.
Disable Unnecessary App Permissions
allReview and restrict app permissions in Settings > Privacy & Security.
🧯 If You Can't Patch
- Implement mobile device management (MDM) to control app installation
- Educate users about risks of installing untrusted applications
🔍 How to Verify
Check if Vulnerable:
Check OS version in Settings > General > About. If version is earlier than patched versions listed above, device is vulnerable.Check Version:
macOS: sw_vers -productVersion; iOS/iPadOS: Settings > General > About > Version; watchOS: Watch app > General > About > VersionVerify Fix Applied:
Confirm OS version matches or exceeds patched versions: macOS Tahoe 26.2, iOS 26.2, iPadOS 26.2, or watchOS 26.2.📡 Detection & Monitoring
Log Indicators:
- Unusual app accessing Safari data directories
- Suspicious app behavior patterns
Network Indicators:
- None - local exploitation only
SIEM Query:
Process accessing ~/Library/Safari/History.db or similar Safari data files by non-Safari apps