CVE-2026-43713: Apple Safari & iOS Permissions Flaw Leaks Sensitive Data

Technical summary

CVE-2026-43713 is a permissions enforcement issue (CWE-284) in Apple's WebKit engine and platform permissions model. The vulnerability allows arbitrary websites to bypass intended restrictions on sensitive data access, resulting in information disclosure. The attack vector is network-based with low complexity; exploitation requires only user interaction (visiting a compromised or attacker-controlled site). No elevation of privilege is needed. The flaw has been remediated across Safari, iOS, iPadOS, and macOS by implementing additional authorization checks at the WebKit or platform layer to prevent unauthorized access to protected resources.

Business impact

Organizations managing fleets of Apple devices face elevated risk of user credential, authentication token, or other sensitive data exfiltration through drive-by web visits. This is particularly concerning for enterprises where employees access corporate applications from Safari or WebKit-based browsers. Data breaches stemming from this vulnerability could compromise authentication chains, API keys, or session tokens, leading to downstream lateral movement or account takeovers. Compliance obligations around PII and PHI protection may be triggered if user data is extracted via this vector.

Affected systems

Safari (version prior to 26.5.2), iOS (prior to 26.5.2), iPadOS (prior to 26.5.2), macOS Tahoe (prior to 26.5.2), tvOS (prior to 26.6), visionOS (prior to 26.6), and watchOS (prior to 26.6). The vulnerability spans Apple's entire ecosystem where WebKit is the rendering engine. Organizations relying on Safari as a primary browser or allowing user device access to corporate web applications should prioritize patching across all affected platforms.

Exploitability

Exploitation is straightforward: an attacker controls a website or compromises an existing high-traffic site, then waits for users to visit. No malware installation, code execution, or privilege escalation is required. The user interaction barrier is minimal—a simple visit triggers the vulnerability. However, the attacker must first identify what sensitive data is accessible and craft a webpage capable of extracting it. Real-world attack campaigns would likely target high-value victims or use watering-hole techniques. The fact that this flaw is not yet in the CISA KEV catalog suggests active exploitation in the wild is not confirmed, but the low technical bar and high-impact data disclosure make it an attractive target for opportunistic attackers.

Remediation

Update to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6 or later. Prioritize iOS and iPadOS devices in mobile-first environments, and Safari on macOS for desktop users. Verify patch deployment using device management tools (MDM/EMM) to confirm no devices are running vulnerable versions. For organizations unable to update immediately, restrict user access to untrusted websites and educate users against clicking links from unknown sources—though this is a weak mitigation given the attack surface.

Patch guidance

Apple has released coordinated patches across its product line. Verify the exact version numbers against Apple's security updates portal before deployment. iOS and iPadOS updates are typically delivered over-the-air; ensure automatic updates are enabled or push updates via MDM. macOS Tahoe 26.5.2 and tvOS/visionOS/watchOS 26.6 should be deployed systematically. Test patches in a limited pilot on representative devices before enterprise rollout to confirm no application compatibility regressions. Monitor Apple's security advisories page for any follow-up patches, as permissions issues sometimes require iterative fixes.

Detection guidance

Monitor for successful visits to suspicious or attacker-controlled domains combined with subsequent unauthorized data access or exfiltration. Examine web proxy or firewall logs for user connections to known malicious sites or watering holes. Implement DNS sinkholing or content filtering to block known attack infrastructure. Use endpoint detection and response (EDR) tools to flag unusual process behavior or unexpected network communications from Safari/WebKit processes. Check for signs of credential compromise or session token abuse that may result from successful exploitation. Device inventory scans should confirm patch compliance and flag any systems still running pre-26.5.2/26.6 versions.

Why prioritize this

Medium severity score (6.5 CVSS) reflects high confidentiality impact but no code execution or system compromise. However, the attack's simplicity, low technical barriers, and direct path to sensitive data exposure warrant prompt patching. Organizations handling PII, financial data, or authentication credentials should prioritize this fix. The absence from KEV indicates either limited observed exploitation or a small exploitation window before patches became widely deployed—do not assume low priority based on KEV status alone.

Risk score, explained

CVSS 3.1 base score of 6.5 (MEDIUM) is calculated as: Network-based attack vector (AV:N), low attack complexity requiring no special tools (AC:L), no privilege requirements (PR:N), user interaction required to visit the site (UI:R), impact scoped to the user session (S:U), high confidentiality impact from data leakage (C:H), no integrity impact (I:N), and no availability impact (A:N). The score appropriately reflects a serious but not critical threat—the data disclosure risk is significant, yet exploitation does not compromise system integrity or availability. Temporal factors (no active exploitation in KEV) do not modify the base score but should inform deployment urgency relative to other patches.

Frequently asked questions