CVE-2025-43228: Apple iPadOS

Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days.

The issue was addressed with improved UI. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6. Visiting a malicious website may lead to address bar spoofing.

Affected products

• Apple iPadOS: before 18.6 (fixed in 18.6)
• Apple iPhone OS: before 18.6 (fixed in 18.6)
• Apple Safari: before 18.6 (fixed in 18.6)

Published 2025-07-30. Last modified 2026-06-17.