Home

Description

A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window.

PUBLISHED Reserved 2025-03-27 | Published 2025-11-21 | Updated 2025-11-23 | Assigner apple

Problem types

A website may be able to spoof the domain name in the title of a pop-up window

Product status

Any version before 15.5
affected

Any version before 18.5
affected

References

support.apple.com/en-us/122716

support.apple.com/en-us/122719

cve.org (CVE-2025-31266)

nvd.nist.gov (CVE-2025-31266)

Download JSON