CVE-2015-5820: Apple iPhone OS

Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days.

WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted (1) tel://, (2) facetime://, or (3) facetime-audio:// URL.

Affected products

• Apple iPhone OS: up to and including 8.4.1
• Apple Safari: up to and including 8.0.8

Published 2015-09-18. Last modified 2026-06-17.