CVE-2026-43715: High-Severity Use-After-Free in Apple Safari and iOS

Technical summary

CVE-2026-43715 is a use-after-free vulnerability (CWE-416) in Apple's WebKit engine that affects Safari and related platforms. The flaw occurs when memory that has been freed is accessed again, allowing an attacker to overwrite or read sensitive data in the process memory space. The vulnerability is triggered through maliciously crafted web content, making the attack surface any webpage visited in Safari or embedded web views in iOS/iPadOS applications. The CVSS 3.1 score of 8.8 (HIGH) reflects the high impact on confidentiality, integrity, and availability, combined with network-based attack vector and user interaction requirement.

Business impact

Organizations supporting Apple device users face operational risk from this vulnerability. Users on unpatched devices remain exposed to potential data theft, session hijacking, or system compromise through drive-by download attacks. For enterprises with BYOD or managed Apple device fleets, delayed patching increases the window of exposure. The vulnerability's reliance on user interaction (visiting a malicious site) makes it moderately exploitable in practice, but widespread web browsing means exposure is difficult to eliminate through policy alone. Business continuity depends on timely user adoption of security updates.

Affected systems

The vulnerability affects: Safari (all versions before 26.5.2), iPhone OS versions before 26.5.2, iPadOS versions before 26.5.2, macOS Tahoe versions before 26.5.2, tvOS versions before 26.6, visionOS versions before 26.6, and watchOS versions before 26.6. Any device running these operating systems with web browsing capability is at risk if users visit untrusted or compromised websites.

Exploitability

Exploitation requires user interaction—specifically, visiting a malicious website or viewing crafted web content in Safari. No authentication is needed, and the attack is network-accessible. However, the attacker must craft specific web content and host it or trick users into visiting the URL. The vulnerability is not known to be actively exploited in the wild (KEV status: not listed), and no public exploit code has been disclosed. The practical barrier is social engineering or compromising a legitimate website. Once triggered, the use-after-free can enable arbitrary code execution or information disclosure.

Remediation

Apply the latest security updates immediately: Safari 26.5.2 or later, iOS 26.5.2 or later, iPadOS 26.5.2 or later, macOS Tahoe 26.5.2 or later, tvOS 26.6 or later, visionOS 26.6 or later, and watchOS 26.6 or later. Users can enable automatic updates in Settings (iOS/iPadOS/macOS) or System Preferences to ensure timely patching. Organizations should verify patch deployment across managed device inventory and communicate update urgency to BYOD users. Testing should be conducted on non-critical devices first to ensure no compatibility issues with business applications.

Patch guidance

Patches became available on or after the 2026-06-29 publication date. Users should prioritize applying updates to Safari and iOS/iPadOS on devices with network access to the internet. For enterprise deployments, test patches in a staging environment before rolling out to production. macOS devices should be updated to Tahoe 26.5.2 or later. Consider enforcing automatic security updates via Mobile Device Management (MDM) for iOS/iPadOS and using macOS configuration profiles to streamline deployment. Verify patch installation by checking System Settings > About > Software Version on each device class.

Detection guidance

Monitor for unusual web browsing activity or unexpected application crashes on affected devices, particularly if multiple users experience similar incidents. Endpoint detection and response (EDR) solutions should flag use-after-free memory access patterns in Safari processes. Network monitors may identify traffic to known malicious domains hosting exploit payloads, though the vulnerability itself leaves minimal forensic artifacts once a system is patched. Conduct device inventory audits to identify which Safari, iOS, iPadOS, and macOS versions are deployed, and cross-reference against the fixed versions listed above. Historical detection is difficult; focus on ensuring all devices are running patched versions going forward.

Why prioritize this

This vulnerability merits high priority due to its HIGH CVSS score (8.8), potential for memory corruption leading to code execution, and wide distribution across consumer and enterprise Apple devices. While active exploitation is not yet documented, the ease of hosting malicious content and the ubiquity of web browsing make exploitation probable if not already occurring. Any device user visiting untrusted websites is at risk. Organizations should treat this as urgent and allocate resources to patch deployment and user communication within the first week of release.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network-based attack vector (AV:N) requiring only internet access; (2) Low attack complexity (AC:L) because no special conditions are needed; (3) No privilege requirement (PR:N); (4) User interaction (UI:R) required to visit a malicious site; (5) Unchanged scope (S:U); and (6) High impact on all three security pillars—confidentiality (C:H) through information disclosure, integrity (I:H) through memory corruption, and availability (A:H) through potential denial of service or system compromise. The use-after-free flaw is a well-understood memory safety issue with serious exploitation potential.

Frequently asked questions