CVE-2026-43708: Apple Safari Cross-Origin Data Exfiltration Vulnerability – Patch Guidance

Technical summary

CVE-2026-43708 is a cross-origin data exfiltration vulnerability stemming from insufficient input validation (CWE-20) in Apple's WebKit engine. The vulnerability permits JavaScript executed in the context of a malicious website to access data from other origins without proper authorization. The attack vector is network-based with low complexity and requires user interaction—specifically, the user must visit the attacker's malicious website. The vulnerability is confined to the confidentiality dimension; integrity and availability are not affected. Remediation involves validating and restricting data access at origin boundaries within the rendering engine.

Business impact

Organizations and individuals using affected Apple devices face risk of credential theft, session hijacking, and sensitive data exposure when users visit malicious websites. The impact is most severe for users handling sensitive information in web applications (banking, healthcare, corporate systems) on Safari. The low CVSS score reflects that exploitation requires social engineering (tricking users to visit a malicious site) and the scope remains limited to confidentiality. However, the ubiquity of Apple devices in enterprise environments means widespread adoption of patches is necessary to reduce risk across the user base.

Affected systems

Vulnerable versions include Safari prior to 26.5.2; iOS and iPadOS prior to 26.5.2; macOS Tahoe prior to 26.5.2; tvOS prior to 26.6; visionOS prior to 26.6; and watchOS prior to 26.6. All products derive from the WebKit rendering engine, making this a platform-wide vulnerability. Devices running these operating systems in any network environment (enterprise, consumer, IoT) are at risk until patched.

Exploitability

Exploitation requires no special privileges or advanced capabilities. An attacker creates a malicious website, then tricks or lures users to visit it—a technique widely used in drive-by download and credential harvesting campaigns. No authentication is needed; the attack succeeds against any user. However, the attacker must influence user behavior to click a link or visit a URL, which introduces friction compared to remotely wormable flaws. Once a user lands on the malicious site, the exfiltration occurs silently in the background. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no active weaponization in the wild at this time.

Remediation

Patch immediately to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, or watchOS 26.6, depending on affected platforms. Apple's patches address the vulnerability through enhanced input validation to enforce origin isolation. For organizations, prioritize patching user-facing devices (iPhones, iPads, Macs) that directly access the internet and web applications. Verify patch deployment through MDM/EMM solutions for iOS and iPadOS. For personal devices, enable automatic software updates to simplify patch management.

Patch guidance

Apply the latest patched versions as published by Apple: verify your device's current OS version in Settings > General > About (or equivalent), then install available updates. For iOS/iPadOS, navigate to Settings > General > Software Update. For macOS, use System Settings > General > Software Update. For tvOS, visionOS, and watchOS, similar paths exist in device settings. Organizations with Apple device management should deploy these patches through their MDM platforms immediately upon release. Test patches in a pilot group before organization-wide rollout to ensure no compatibility issues with line-of-business applications.

Detection guidance

Monitor for user visits to known malicious or suspicious websites via web proxy or DNS logs. Implement Content Security Policy (CSP) headers on internal web applications to further restrict cross-origin access and mitigate similar attacks. Check Apple device inventory and patch compliance reports via MDM to identify and remediate unpatched systems. Endpoint Detection and Response (EDR) tools may flag unusual data exfiltration patterns, though this attack is designed to blend into normal browser traffic. Consider threat intelligence feeds focused on phishing and malicious website hosting to identify attack infrastructure.

Why prioritize this

Although the CVSS score of 4.3 (MEDIUM) is modest, the ubiquity of Apple devices in both consumer and enterprise settings, combined with the ease of social engineering required for exploitation, warrants swift patching. The vulnerability affects core browser functionality across seven operating systems, making it a platform-wide risk. The absence of current public weaponization reduces urgency slightly, but organizations should assume threat actors are monitoring this CVE and will develop exploits. Prioritize patching devices belonging to high-value targets (executives, developers, security teams) and users accessing sensitive web applications, then roll out enterprise-wide.

Risk score, explained

The CVSS v3.1 score of 4.3 reflects a network-based attack with low complexity and low impact (confidentiality only, no integrity or availability loss). The requirement for user interaction (clicking a link) and the lack of scope expansion (no privilege escalation) keep the score in the MEDIUM range. However, the practical risk is elevated by the attack's invisibility to the user and the prevalence of Safari/Apple devices, so organizations should treat this as a higher priority than the raw CVSS number might suggest.

Frequently asked questions