CVE-2026-43721: Apple Clipboard Hijacking Vulnerability in Safari, iOS, macOS

Technical summary

The vulnerability results from inadequate state management in Apple's browser and OS implementations, specifically in the clipboard access control mechanism. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates network-based attack requiring only user interaction, with high confidentiality impact but no integrity or availability impact. This aligns with CWE-732 (Incorrect Permission Assignment), suggesting the system fails to properly enforce or maintain clipboard access restrictions. A malicious website can exploit this to exfiltrate clipboard contents without triggering permission prompts or user-visible indicators.

Business impact

Organizations relying on Apple devices—particularly iOS and macOS users in the workforce—face elevated risk of credential theft and data exfiltration. Clipboard data often contains high-value secrets: OAuth tokens, API keys, passwords, and sensitive communications. An attacker controlling a malicious website or compromising ad networks can harvest such data at scale, with victims unaware their clipboard has been accessed. This undermines security posture for companies enforcing 'copy as workaround' for password managers or MFA flows, and increases incident response burden if breaches occur post-attack.

Affected systems

Apple Safari, iOS, iPadOS, and macOS are affected. Specific fixed versions include Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Any user on unpatched versions of these platforms running Safari or using in-app WebKit-based browsers is exposed. Enterprise environments with mixed Apple device fleets and delayed OS update cycles face variable exposure windows.

Exploitability

Exploitation requires medium effort: an attacker must craft or control a malicious website and convince users to visit it. No special privileges or exploit code are needed. The attack is silent and leaves minimal forensic traces, making detection difficult. However, it does not work against users who have never copied sensitive data, and browser-level clipboard protections (e.g., refusing access to certain data types) may partially mitigate damage. The lack of active KEV/CISA tracking suggests no widespread weaponized exploitation has been publicly documented at publication time, though the ease of attack and high value of clipboard data make this a probable target for opportunistic attackers.

Remediation

Apply the patched versions immediately: Safari 26.5.2 or later, iOS 26.5.2 or later, iPadOS 26.5.2 or later, and corresponding macOS Tahoe 26.5.2 or later updates. For tvOS, visionOS, and watchOS, upgrade to 26.6 or later. Prioritize devices used by high-value targets (executives, developers, security staff) and those in sensitive roles. Until patched, consider user awareness campaigns warning against visiting untrusted websites and advise users to clear clipboard data after copying sensitive information.

Patch guidance

Patches are available across all affected platforms. For end-user devices, enable automatic OS and browser updates where organizational policy permits. For managed fleets, deploy patches through MDM solutions targeting Safari and OS versions sequentially, beginning with high-risk user groups. Verify patch application by confirming installed versions match the fixed versions listed in Apple's security advisory. No interim mitigations are available; patching is the only remediation.

Detection guidance

Monitor for unusual clipboard access patterns in enterprise endpoint detection and response (EDR) solutions. Safari logs may record unexpected clipboard queries; review browser history for visits to suspicious or untrusted domains around times of known data theft incidents. On iOS/iPadOS, some MDM solutions can audit app-level clipboard usage; configure alerts for non-standard access. Passive network monitoring may detect exfiltration of clipboard-like data by correlating copy-paste timing with outbound connections, though this requires baselining normal user behavior. Post-breach forensics should include timeline analysis of clipboard access events if logs are retained.

Why prioritize this

This vulnerability merits urgent but not emergency prioritization. CVSS 6.5 (MEDIUM) reflects the balance between silent exploitation and user-interaction requirement. However, the attack vector targets a ubiquitous user behavior (copying sensitive data) and affects multiple major Apple platforms used in enterprise. The lack of known active exploitation provides a narrow window to patch before attackers optimize tooling. Organizations with high-value users (finance, legal, engineering, security teams) should patch within 2–4 weeks; others should follow within 30 days.

Risk score, explained

The CVSS 6.5 score appropriately reflects a network-based attack requiring user interaction, with high confidentiality impact and no direct integrity or availability consequences. The score does not account for contextual factors such as the typical high value of clipboard data, silent exploitation, or the prevalence of Apple devices in security-sensitive organizations—factors that elevate practical risk above the raw numeric score. This is a classic example where business context and threat actor capability should inform patching urgency beyond the base CVSS metric.

Frequently asked questions