CVE-2025-24208 is a permissions issue in Safari, iOS, and iPadOS that was addressed by adding additional restrictions. The vulnerability could allow a cross-site scripting (XSS) attack via loading a malicious iframe. The issue is fixed in Safari 18.4, iOS 18.4, and iPadOS 18.4.