CVE-2025-43376: 
Apple Safari vulnerability analysis and mitigation

CVE-2025-43376 is a logic flaw in Apple's WebKit engine that causes DNS queries to leak to remote attackers even when iCloud Private Relay is enabled. The vulnerability was discovered by Mike Cardwell of grepular.com and Bob Lord, and was first disclosed by Apple on September 15, 2025, with the CVE formally published on November 3–4, 2025. It affects Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS — all versions prior to the "26" release series, with an additional backport fix in iOS 18.7.7 and iPadOS 18.7.7. It carries a CVSS v3.1 base score of 7.5 (High) (Apple Advisory - Safari 26, Apple Advisory - iOS 26).

The vulnerability is rooted in a logic error in WebKit's state management (classified as NVD-CWE-noinfo due to insufficient public detail), specifically tracked under WebKit Bugzilla #295943. When Private Relay is active, a state management flaw causes DNS resolution requests to bypass the relay tunnel and be sent in a manner observable by a network-positioned attacker. No user interaction is required, and the attack is network-accessible with low complexity and no privileges needed. No public technical write-up or proof-of-concept code has been released as of the time of this report (Apple Advisory - Safari 26, Apple Advisory - iOS 26).

Successful exploitation allows an unauthenticated remote attacker to observe DNS queries made by a victim device, effectively de-anonymizing the user's browsing activity and domain visit patterns despite Private Relay being enabled. The confidentiality impact is rated High, as DNS query data can reveal which websites a user visits, potentially enabling targeted surveillance, profiling, or follow-on phishing attacks. There is no integrity or availability impact; the vulnerability is purely a privacy/confidentiality issue (Apple Advisory - visionOS 26, Apple Advisory - tvOS 26).

Apple has released patches across all affected platforms. Users should update to Safari 26, iOS 18.7.7 or iPadOS 18.7.7 (for legacy devices), iOS 26, iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, or watchOS 26. As a temporary workaround, users for whom maximum privacy is critical should consider disabling iCloud Private Relay until patching is complete, since the feature's privacy guarantees are undermined by this flaw. Prioritize updating Safari and mobile operating systems (iOS/iPadOS) given their widespread use (Apple Advisory - iOS 26, Apple Advisory - Safari 26, Apple Advisory - iOS 18.7.7).

The vulnerability was covered in security-focused media outlets including GBHackers and CyberPress in the context of the iOS 18.7.7 update release. The SANS Internet Storm Center noted the March 2026 Apple patch batch (which updated the CVE description to include additional affected platforms) in diary entry #32830. CIS Security issued an advisory covering multiple vulnerabilities in the same Apple update cycle. No significant independent researcher commentary or social media controversy has been observed beyond standard patch reporting (SANS ISC Diary, CIS Advisory).