CVE-2025-24150

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.3 Safari versions prior to 18.3 iOS versions prior to 18.3 iPadOS versions prior to 18.3

Description A privacy issue was addressed with improved handling of files. Copying a URL from Web Inspector may lead to command injection. The issue is related to the Web Inspector tool in iOS, iPadOS, macOS, and Safari, which is associated with a lack of data sanitization at the management level. This may allow a remote attacker to execute arbitrary commands.

Recommendations For macOS Sequoia versions prior to 15.3, update to macOS Sequoia 15.3 to resolve the issue. For Safari versions prior to 18.3, update to Safari 18.3 to resolve the issue. For iOS versions prior to 18.3, update to iOS 18.3 to resolve the issue. For iPadOS versions prior to 18.3, update to iPadOS 18.3 to resolve the issue. As a temporary workaround, consider avoiding copying URLs from Web Inspector until a patch is available. Restrict access to the Web Inspector tool to minimize the risk of exploitation.