Critical· 9.8official fix available
CVE-2025-24259
A critical flaw in macOS allows apps to read Safari bookmarks without proper permission checks.
publishedMar 31, 2025
last modifiedJul 23, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
50th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 25, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
macOS users running versions older than Sequoia 15.4, Sonoma 14.7.5, or Ventura 13.7.5.
02
Real-world impact
An attacker could harvest a victim’s Safari bookmarks, revealing visited sites and potentially sensitive information, and could use that data for phishing or other malicious activities.
03
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely with no authentication, giving complete confidentiality, integrity, and availability damage to the user’s data.
04
What to do about it
official fix available
recommended steps
- 01Update macOS to Sequoia 15.4, Sonoma 14.7.5, Ventura 13.7.5, or later.
NVD-referenced vendor advisory
05
Timeline
- Mar 31, 2025 · Mar 31, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
- support.apple.com/en-us/122373vendor advisory
- support.apple.com/en-us/122374vendor advisory
- support.apple.com/en-us/122375vendor advisory
- support.apple.com/en-us/122405
- seclists.org/fulldisclosure/2025/Apr/10
- seclists.org/fulldisclosure/2025/Apr/8
- seclists.org/fulldisclosure/2025/Apr/9
- seclists.org/fulldisclosure/2025/May/6
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →