CVE-2026-43731: Critical Apple Safari Use-After-Free Vulnerability – Patch Now

Technical summary

CVE-2026-43731 is a use-after-free vulnerability (CWE-416) affecting Apple's WebKit rendering engine as shipped in Safari, iOS, iPadOS, and macOS. The vulnerability arises when memory management routines fail to prevent access to freed heap objects during web content processing. An attacker can structure malicious HTML, JavaScript, or media content to trigger this condition, resulting in memory corruption that may allow code execution in the browser's security context. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) due to the combination of network-based attack vector, low complexity, no privilege requirement, and high impact across confidentiality, integrity, and availability.

Business impact

Organizations with users accessing the internet via Apple devices—particularly macOS and iOS workforces—face elevated risk of data theft, malware infection, and device compromise. The vulnerability could enable targeted attacks against specific employees or widespread compromise through watering-hole techniques. Unlike vulnerabilities requiring privilege escalation, this one operates at the user level, making it particularly dangerous for organizations lacking comprehensive endpoint detection. Attackers could harvest credentials, install persistence mechanisms, or pivot to corporate networks via compromised employee devices.

Affected systems

Apple Safari (all versions prior to 26.5.2), iOS (prior to 26.5.2), iPadOS (prior to 26.5.2), and macOS Tahoe (prior to 26.5.2) are vulnerable. Separate patched versions exist for tvOS, visionOS, and watchOS (all 26.6 or later), indicating this vulnerability affects Apple's broader ecosystem. Any device running these unpatched versions is at risk when users browse the internet or view untrusted web content.

Exploitability

Exploitation requires minimal attacker capability: hosting a malicious website or compromising a legitimate site through which victims will be redirected. The attack vector is entirely remote over the network, requires no authentication or special privileges, and only needs the user to visit the crafted content—a realistic scenario given the prevalence of drive-by attacks, malicious advertisements, and social engineering. No working exploit is currently listed in CISA's Known Exploited Vulnerabilities catalog, but the straightforward nature of the vulnerability class suggests practical exploitation is achievable. The high CVSS score and broad impact surface make this an attractive target for both criminal and state-sponsored threat actors.

Remediation

Users and administrators must apply Apple's security updates immediately. End users should update to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, or macOS Tahoe 26.5.2 depending on their device. Administrators managing corporate Apple deployments should enforce these updates via Mobile Device Management (MDM) solutions and configuration profiles. Until patched, mitigating browser-level exposure through network controls (blocking access to untrusted internet content) offers partial protection but is not a reliable substitute for patching.

Patch guidance

Apple has released coordinated updates across its platform: Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Verify availability in your organization's supported OS versions via Apple Security Updates (support.apple.com). For macOS environments, deploy via Software Update or MDM to enforce compliance. For iOS/iPadOS, use MDM device management policies or direct user communication to encourage immediate installation. Test updates in non-production environments first to ensure compatibility with line-of-business applications before broad rollout.

Detection guidance

Monitor for exploitation indicators at the endpoint level: unusual process spawning from Safari or WebKit processes, unexpected network connections initiated by Safari, and memory corruption symptoms (application crashes with memory-access violations). Network-based detection is challenging since the attack occurs during legitimate web browsing. Implement web content filtering to block known malicious domains if intelligence is available. Log and review access to suspicious or newly registered domains from corporate devices. EDR solutions capable of memory forensics may detect post-exploitation artifacts if code execution occurs.

Why prioritize this

This vulnerability merits immediate priority due to its high CVSS score (8.8), broad platform impact, low exploitation complexity, and the widespread use of Apple devices in enterprise environments. The attack requires only user interaction—a highly likely scenario—and carries severe consequences (code execution and data theft). Organizations should treat this as a critical patch and accelerate deployment timelines accordingly.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a network-accessible vulnerability with no special requirements for exploitation, combined with high impact across confidentiality (data theft), integrity (malware installation), and availability (denial of service or device lockdown). The primary limiting factor is the requirement for user interaction (visiting a malicious site), which reduces the score from critical (9.0+) to high (8.0–8.9). The breadth of affected products and user-facing nature of web browsing amplify real-world risk beyond the numerical score.

Frequently asked questions