CVE-2015-5825

WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.

• CWE-200

• http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00007.htmlVendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html
• http://www.securityfocus.com/bid/76766
• http://www.securitytracker.com/id/1033609
• https://support.apple.com/HT205212Vendor Advisory
• https://support.apple.com/HT205265Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00007.htmlVendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-03/msg00054.html
• http://www.securityfocus.com/bid/76766
• http://www.securitytracker.com/id/1033609
• https://support.apple.com/HT205212Vendor Advisory
• https://support.apple.com/HT205265Vendor Advisory

Published

Sep 18, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5819WebKit, as used in Apple iOS before 9 and iTunes before 12.3…
• CVE-2015-5820WebKit in Apple iOS before 9 allows remote attackers to trig…
• CVE-2015-5821WebKit, as used in Apple iOS before 9 and iTunes before 12.3…
• CVE-2015-5822WebKit, as used in JavaScriptCore in Apple iOS before 9 and …
• CVE-2015-5823WebKit, as used in JavaScriptCore in Apple iOS before 9 and …
• CVE-2015-5824The NSURL implementation in the CFNetwork SSL component in A…
• CVE-2015-5826WebKit in Apple iOS before 9 does not properly select the ca…
• CVE-2015-5827WebKit in Apple iOS before 9 allows remote attackers to bypa…
• CVE-2015-5828The API in the WebKit Plug-ins component in Apple Safari bef…
• CVE-2015-5829Data Detectors Engine in Apple iOS before 9 allows remote at…
• CVE-2015-5830The Intel Graphics Driver component in Apple OS X before 10.…
• CVE-2015-5831NetworkExtension in the kernel in Apple iOS before 9 does no…