CVE-2026-43700: Apple Cross-Origin Tracking Vulnerability – Safari, iOS, macOS Patch

Technical summary

CVE-2026-43700 is a cross-origin tracking vulnerability stemming from inadequate security origin validation (CWE-346). The issue allowed an attacker to craft web content that circumvented the same-origin policy by exploiting insufficient tracking of security contexts. When a user processes this malicious content in Safari or related browsers, the browser fails to properly isolate data by origin, permitting unauthorized disclosure of sensitive information. The vulnerability requires user interaction (visiting the malicious content) but does not require authentication or special privileges to exploit.

Business impact

Organizations with users who browse the web using affected Apple devices face a risk of sensitive data leakage if employees or customers visit compromised websites. This is particularly concerning for enterprises handling confidential information (financial data, proprietary research, customer PII) where web browsing is part of normal workflow. The medium severity reflects the need for user interaction and the confidentiality-only impact, but widespread deployment of Safari on mobile and desktop platforms means the attack surface is substantial. Data exfiltration can occur silently, complicating detection and incident response.

Affected systems

The vulnerability affects Safari 26.5.1 and earlier, iOS 26.5.1 and earlier, iPadOS 26.5.1 and earlier, macOS Tahoe 26.5.1 and earlier, tvOS 26.5 and earlier, visionOS 26.5 and earlier, and watchOS 26.5 and earlier. All major Apple platforms are in scope. Organizations relying on Apple devices for corporate use or customer-facing services should inventory Safari users and apply patches across macOS, iPhone, and iPad devices. TV and wearable devices may be lower priority depending on organizational use.

Exploitability

The attack requires user interaction (visiting malicious content) and network access but no authentication. An attacker can host the malicious content on a website, inject it into legitimate sites via compromise, or distribute it via phishing. The barrier to exploitation is relatively low—typical users cannot easily distinguish a compromised page from a legitimate one. However, the vulnerability is not remotely exploitable without user engagement. The issue is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been widely documented at the time of this advisory, though this should not be interpreted as proof the vulnerability is unexploited.

Remediation

Users and administrators should immediately update affected devices to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6 or later. For organizations managing multiple devices, deploy updates via Mobile Device Management (MDM) or macOS management tools to ensure consistent patching. Prioritize laptops and phones used by employees with access to sensitive systems. Verify update completion before considering remediation closed.

Patch guidance

Apple has released patched versions across all affected platforms. For macOS users, update to macOS Tahoe 26.5.2 or later via System Preferences > Software Update. iOS and iPadOS users should navigate to Settings > General > Software Update. tvOS, visionOS, and watchOS updates are similarly available through each platform's settings. Enterprise administrators should configure automatic updates or push patches via MDM to minimize deployment time. Test patches in a small pilot group first to ensure compatibility with critical business applications, then roll out organization-wide. Monitor patch deployment rates and follow up with non-compliant devices.

Detection guidance

Detection of exploitation is challenging because the vulnerability results in silent data exfiltration without obvious system symptoms. Organizations can implement the following controls: (1) Monitor web traffic for unusual data flows to suspicious destinations from Safari processes, particularly on sensitive networks. (2) Use endpoint detection and response (EDR) tools to flag abnormal credential or sensitive file access patterns following web browsing activity. (3) Conduct log analysis on systems handling sensitive data to identify unexpected data access or exfiltration. (4) Maintain an inventory of patched vs. unpatched Safari instances to identify at-risk users. (5) Educate users on phishing and malicious site indicators, since user interaction is required. Network segmentation and data loss prevention tools can help contain the blast radius if exploitation is suspected.

Why prioritize this

Despite CVSS 6.5 (medium) severity, this vulnerability warrants prompt patching due to its wide attack surface (all major Apple platforms), the silent nature of data exfiltration, and the universal exposure of web-browsing users. The lack of KEV listing should not delay remediation—it reflects lack of documented widespread exploitation, not absence of risk. Organizations should prioritize patching within 2–4 weeks for general populations and within 1 week for high-risk users (finance, legal, R&D, executive staff) who handle sensitive data.

Risk score, explained

The CVSS 6.5 score reflects a network-based attack requiring user interaction (AV:N/AC:L/PR:N/UI:R) that can disclose sensitive information (C:H) but does not compromise system integrity or availability (I:N/A:N). The score appropriately captures the realistic risk: a real attacker needs a victim to click or visit, but once that bar is met, confidential data can leak without further barriers. The unchanged scope (S:U) indicates the impact is limited to the user's own data, not cross-user or cross-privilege-level impacts. For organizations with sensitive data, this translates to meaningful risk.

Frequently asked questions