CVE-2022-46695mediumobserved exploitationCWE-1021

CVE-2022-46695: medium-severity vulnerability in Apple tvOS

Published · Updated

Follow this CVE+ Monitor watchOS+ Monitor tvOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

35Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Attendcvss 6.5epss 1.4%
from disclosure to weapon
Published on NVDDec 15
VulnCheckDec 13
In short

A website could trick users by displaying fake UI elements through framed content, making them think they're interacting with legitimate parts of the interface. This was fixed by improving how Apple systems validate URLs.

Technical detail

URL spoofing vulnerability in Apple platforms' frame handling mechanism allowed attackers to craft malicious web content that, when framed, could visually spoof legitimate UI elements. The attack requires user interaction (visiting a malicious website) and was mitigated through enhanced input validation of URL parameters across affected OS versions.

Summary generated and translated by AI from the official description.
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Visiting a website that frames malicious content may lead to UI spoofing.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
Apple · tvOSApple · watchOS
Related CVEs — Apple tvOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 51.5%KEVCVE-2025-43529HIGHCVE-2025-43529EPSS 25.7%KEVCVE-2020-27930HIGHCVE-2020-27930EPSS 22.0%KEVCVE-2025-31200CRITICALCVE-2025-31200EPSS 20.9%KEVCVE-2023-37450HIGHCVE-2023-37450EPSS 18.9%KEV