CVE-2026-43705: High-Severity Type Confusion in Apple Safari and WebKit—Patch Guidance

Technical summary

CVE-2026-43705 is a type confusion vulnerability (CWE-843) in WebKit, the rendering engine powering Safari and other Apple browsers. Type confusion occurs when code makes incorrect assumptions about an object's data type, allowing an attacker to manipulate memory in unintended ways. In this case, processing maliciously crafted web content triggers the type confusion, resulting in memory corruption. The vulnerability was patched through improved type-checking logic in the affected codebases.

Business impact

Organizations with Apple device fleets face risk of browser-based compromise. A successful exploit could allow attackers to steal sensitive data from web sessions, inject malicious content, or achieve remote code execution—potentially affecting employees accessing internal systems, financial data, or communications through Safari. The HIGH CVSS score (8.8) and ease of delivery (network, low complexity) make this a material risk to business continuity and data security.

Affected systems

Safari 26.5.1 and earlier on macOS; Safari on iOS and iPadOS versions earlier than 26.5.2; iOS versions earlier than 26.5.2; iPadOS versions earlier than 26.5.2; macOS Tahoe versions earlier than 26.5.2; tvOS versions earlier than 26.6; visionOS versions earlier than 26.6; watchOS versions earlier than 26.6. Any Apple device running these operating systems with an unpatched browser is vulnerable.

Exploitability

Exploitability is straightforward: no authentication, no elevated privileges, and only requires the user to visit a malicious webpage. The attack vector is network-based and the attack complexity is low. However, user interaction (clicking a link or visiting a site) is required, which slightly raises the bar compared to entirely passive network attacks. No public exploit appears to exist in the KEV catalog, but the low barrier to exploitation makes this a priority for rapid patching.

Remediation

Update to Safari 26.5.2 (or later) on macOS Tahoe and earlier; iOS 26.5.2 (or later); iPadOS 26.5.2 (or later); tvOS 26.6 (or later); visionOS 26.6 (or later); and watchOS 26.6 (or later). Verify exact build numbers in Apple's security updates, as point releases may vary. Enterprises should prioritize patching user-facing devices and any systems browsing untrusted content.

Patch guidance

Apply updates through Apple's standard Software Update mechanism on each device type. For macOS, navigate to System Settings > General > Software Update. For iOS/iPadOS, use Settings > General > Software Update. For enterprises, deploy updates via Mobile Device Management (MDM) solutions (Apple Business Manager, Intune, Jamf, etc.). Patch as soon as possible given the ease of attack; recommend target completion within 2 weeks. Verify patch installation by checking version numbers post-update.

Detection guidance

Look for suspicious WebKit crashes or unexpected memory faults in system logs, particularly if correlated with user web-browsing activity or suspicious web referrals. On macOS, examine Console logs for Safari crash dumps. On iOS/iPadOS, check device logs via Xcode or MDM analytics for abnormal terminations. Network-level detection is difficult since the exploit is delivered via HTTPS. Focus on endpoint telemetry: monitor for unexpected process behavior following web browsing, and alert on crash dumps mentioning WebKit/JavaScriptCore. EDR tools should flag suspicious memory access patterns post-browser interaction.

Why prioritize this

This vulnerability warrants immediate prioritization due to the combination of HIGH CVSS score (8.8), low-complexity network attack vector, minimal user friction (user interaction rather than no interaction), and broad device coverage. Type confusion leading to memory corruption is a classic stepping stone to arbitrary code execution. The lack of KEV listing suggests no active mass exploitation yet, but the simplicity of attack makes one-off exploits likely. Rapid patching prevents opportunistic compromise.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege escalation required (PR:N), user interaction needed (UI:R), single system impact (S:U), and high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures the severity of memory corruption through a web browser—a critical trust boundary—while accounting for the user-interaction requirement. No temporal adjustments are present since exploitation is not yet observed in the wild on this scale.

Frequently asked questions