CVE-2025-51497
📋 TL;DR
The AdGuard Safari plugin before version 1.11.22 logged every URL accessed by Safari into macOS system logs, which were readable by any unsandboxed process. This exposed users' browsing history to local attackers or malicious software. Only macOS users with the vulnerable AdGuard Safari plugin are affected.
💻 Affected Systems
- AdGuard for Safari
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access or malware could extract complete browsing history including sensitive sites (banking, healthcare, private communications), enabling profiling, blackmail, or credential theft.
Likely Case
Malware or other local processes could silently collect browsing patterns and visited URLs for advertising, tracking, or reconnaissance purposes.
If Mitigated
With proper access controls and updated software, the logs would not contain URL data or would be inaccessible to unauthorized processes.
🎯 Exploit Status
Exploitation requires local access or malware that can read system logs. No authentication bypass needed beyond local access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.22
Vendor Advisory: https://adguard.com/en/adguard-safari/overview.html
Restart Required: Yes
Instructions:
1. Open Safari. 2. Go to Safari Extensions. 3. Find AdGuard. 4. Check for updates or manually update to 1.11.22+. 5. Restart Safari.
🔧 Temporary Workarounds
Disable AdGuard logging
allTurn off verbose logging in AdGuard settings if available in older versions
Restrict log access
linuxSet stricter permissions on macOS system logs to prevent unauthorized reading
sudo chmod 640 /var/log/system.log
sudo chmod 640 /var/log/*.log
🧯 If You Can't Patch
- Uninstall AdGuard for Safari plugin
- Use alternative ad-blocking solutions
🔍 How to Verify
Check if Vulnerable:
Check AdGuard version in Safari extensions. If version < 1.11.22, check system logs for URL entries: grep -i 'adguard\|url' /var/log/system.logCheck Version:
Safari → Extensions → AdGuard → Version infoVerify Fix Applied:
Update to 1.11.22+, restart Safari, verify no URL logging in system logs after browsing📡 Detection & Monitoring
Log Indicators:
- URL entries in macOS system logs from AdGuard process
- Excessive logging of web requests
SIEM Query:
source="system.log" AND process="AdGuard" AND (url OR http OR https)