A spoofing issue existed in the handling of URLs.
Priority LOW 22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 4 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, Safari 16.2. Visiting a malicious website may lead to address bar spoofing.
Why it matters now
EPSS 0.00973 62nd percentileScored 2026-11-07
Fix Partial macOS (Apple): 13.1, 16.2Red Hat: 3 advisoriesRed Hat: 4 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apple | macOS | before 13.1 | 13.1 | Patch available | CNA |
| Apple | macOS | before 16.2 | 16.2 | Patch available | CNA |
| Apple | macOS | before 16.2 | 16.2 | Patch available | CNA |
- macOS VendorApple Affected before 13.1 Fixed in 13.1 Patch available CNA
- macOS VendorApple Affected before 16.2 Fixed in 16.2 Patch available CNA
- macOS VendorApple Affected before 16.2 Fixed in 16.2 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* | before 16.2 | Vulnerable | Apple |
| cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | before 15.7.2; 16.0 to before 16.2 | Vulnerable | Apple |
| cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | before 15.7.2; 16.0 to before 16.2 | Vulnerable | Apple |
| cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | before 13.1 | Vulnerable | Apple |
| cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* | before 16.2 | Vulnerable | Apple |
| cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* | before 9.2 | Vulnerable | Apple |
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* Versions before 16.2 Vulnerable ·Apple
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* Versions before 15.7.2; 16.0 to before 16.2 Vulnerable ·Apple
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions before 15.7.2; 16.0 to before 16.2 Vulnerable ·Apple
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions before 13.1 Vulnerable ·Apple
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* Versions before 16.2 Vulnerable ·Apple
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* Versions before 9.2 Vulnerable ·Apple
Remediation
- Fix · CNA macOS (Apple) Fixed in 13.1
- Fix · CNA macOS (Apple) Fixed in 16.2
- Fix · CNA macOS (Apple) Fixed in 16.2
Red Hat 3 advisories
- RHSA-2025:10364 Released 2025-07-07 · Red Hat rating Importantwebkitgtk4 security update
- Red Hat Enterprise Linux Server (v. 7 ELS) webkitgtk4-2.48.3-2.el7_9, webkitgtk4-devel-2.48.3-2.el7_9, webkitgtk4-jsc-2.48.3-2.el7_9 +1
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) webkitgtk4-devel-2.48.3-2.el7_9, webkitgtk4-doc-2.48.3-2.el7_9, webkitgtk4-jsc-devel-2.48.3-2.el7_9
- RHSA-2023:7055 Released 2023-11-14 · Red Hat rating Importantwebkit2gtk3 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) webkit2gtk3-2.40.5-1.el8, webkit2gtk3-devel-2.40.5-1.el8, webkit2gtk3-jsc-2.40.5-1.el8 +1
- RHSA-2023:6535 Released 2023-11-07 · Red Hat rating Importantwebkit2gtk3 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) webkit2gtk3-2.40.5-1.el9, webkit2gtk3-devel-2.40.5-1.el9, webkit2gtk3-jsc-2.40.5-1.el9 +1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Apple macOS 13.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-23094 Incorrect authorization in Apple macOSPriority LOW 24
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:7055 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:6535 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2025:10364 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2025:10364 |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-46705
- 2026-10-03 Alias added: GHSA-wx4m-4gqh-j3gc
References
Advisory 8
- https://support.apple.com/kb/HT213531
- https://support.apple.com/kb/HT213536
- https://support.apple.com/kb/HT213535
- https://support.apple.com/en-us/HT213532
- https://support.apple.com/en-us/HT213530
- https://support.apple.com/en-us/HT213537
- https://support.apple.com/kb/HT213676
- [oss-security] 20231115 WebKitGTK and WPE WebKit Security Advisory WSA-2023-0010
More Apple Ipados vulnerabilities
- TI-2025-28008 Out-of-bounds write in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
- TI-2025-22441 Apple iOS and iPadOS: An attacker with arbitrary read and write capability may be able to… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-22440 Memory corruption in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8
- TI-2025-17951 Out-of-bounds write in Apple Safari KEVCVSS 3.1CRITICAL 10.0
- TI-2025-17847 Use after free in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
- TI-2022-06854 Out-of-bounds write in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-46705 · CVE Program
- CVE-2022-46705 · NVD
- FIRST EPSS
- GHSA-wx4m-4gqh-j3gc · GitHub Advisory Database · CC BY 4.0
- CVE-2022-46705 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences