CVE-2026-43704: Apple Safari Use-After-Free Memory Vulnerability (CVSS 5.3)

Technical summary

This use-after-free vulnerability (CWE-416) occurs when Safari or dependent Apple operating systems attempt to access memory regions that have already been deallocated. A malicious web extension can trigger this condition to cause a denial-of-service through unexpected process termination. The vulnerability requires user interaction (extension installation or activation) and specific environmental conditions, as reflected in the CVSS vector AV:N/AC:H/PR:N/UI:R. The flaw was remediated through improved memory management practices in the affected components.

Business impact

For organizations deploying Safari or Apple devices as standard endpoints, this vulnerability creates a localized availability risk. An attacker distributing a malicious web extension through unofficial channels or via social engineering could disrupt user productivity through repeated browser crashes. The impact is contained to individual processes rather than system-wide compromise, but repeated crashes may trigger incident response workflows and reduce end-user confidence. Financial impact is limited unless the browser crash interferes with critical business workflows.

Affected systems

The vulnerability affects Safari 26.5.1 and earlier, iOS 26.5.1 and earlier, iPadOS 26.5.1 and earlier, macOS Tahoe 26.5.1 and earlier, tvOS 26.5 and earlier, visionOS 26.5 and earlier, and watchOS 26.5 and earlier. All major Apple platforms that support web browsing and extensions are in scope. The attack surface is widest on devices where users frequently install third-party extensions or access untrusted extension marketplaces.

Exploitability

Exploitability is moderate. An attacker must convince a user to install a malicious web extension, which typically requires social engineering or distribution through compromised or unofficial channels. No user privilege escalation is necessary, and the exploit does not require network connectivity once the extension is loaded. However, the high complexity (AC:H) and user interaction requirement (UI:R) limit the practical attack surface. This is not a zero-click or zero-interaction vulnerability, and there is no evidence of active exploitation in the wild.

Remediation

Update affected Apple products to the patched versions: Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6 or later. Additionally, audit installed web extensions across your fleet and remove any from untrusted sources. Educate users on the risks of installing extensions from unofficial marketplaces and implement browser extension management policies where feasible.

Patch guidance

Apply security updates as follows: iOS and iPadOS users should update to 26.5.2 or later via Settings > General > Software Update. macOS Tahoe users should update to 26.5.2 or later via System Settings > General > Software Update. Safari standalone should be updated to 26.5.2 or later; updates are typically bundled with OS releases or available through the App Store. tvOS, visionOS, and watchOS users should check their respective update mechanisms. Verify patch installation by confirming the version number in Settings or About dialogs. No workarounds are available; patching is the definitive remediation.

Detection guidance

Monitor for unexpected Safari process crashes, particularly when extensions are active. Enable crash reporting and log aggregation to identify patterns of sudden termination. In enterprise environments, use Mobile Device Management (MDM) to audit installed extensions and flag installations from unverified sources. Log access to browser extension installation features and correlate with user accounts. Look for anomalous extension installations coinciding with user reports of browser instability. Review extension permissions for any recently installed extensions; legitimate extensions should have clearly defined scopes.

Why prioritize this

This vulnerability should be patched within your standard update cycle for Apple devices, typically 30 days. While the CVSS score of 5.3 is moderate, the requirement for user interaction and the absence of KEV status indicate this is not an emergency. However, organizations with strict browser stability requirements or high concentrations of extension-dependent workflows should prioritize patching within 2–3 weeks. Organizations with user-controlled extension installation should treat this as higher priority than those with centrally managed extension policies.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium) reflects the limited attack surface: the vulnerability requires user interaction to install a malicious extension (UI:R), high complexity to trigger (AC:H), and no network privileges (PR:N). The impact is confined to availability (A:H) with no confidentiality or integrity compromise. The score is not elevated to 'High' because exploitation requires social engineering and user consent. The absence of KEV listing indicates no active exploitation has been reported to CISA, supporting a measured rather than emergency response.

Frequently asked questions