CVE-2025-43480

Overview

Advisory: Apple Security Advisory

Impact:

Description: A malicious website may exfiltrate data cross-origin

Researchers: Aleksejs Popovs

Attribute	Value
CVE	CVE-2025-43480
Bugzilla	276208
Component	WebCore
Bug Class	CrossOrigin
Severity	medium
Commit	0473037b55025aeb…
Advisory	Apple Advisory

Root Cause Analysis

The issue was addressed with improved checks.

Files Changed

Source Files

• Source/WebCore/loader/MediaResourceLoader.cpp
• Source/WebCore/loader/MediaResourceLoader.h

Test Files

• LayoutTests/http/tests/media/resources/hls/.htaccess
• LayoutTests/http/tests/performance/performance-resource-timing-cross-origin-media-expected.txt
• LayoutTests/http/tests/performance/performance-resource-timing-cross-origin-media-with-cors-expected.txt
• LayoutTests/http/tests/performance/performance-resource-timing-cross-origin-media-with-cors.html
• LayoutTests/http/tests/performance/performance-resource-timing-cross-origin-media.html
• LayoutTests/platform/glib/TestExpectations
• LayoutTests/platform/win/TestExpectations