CVE-2026-43735: Safari Cross-Origin Data Exfiltration Vulnerability – Patching Guide

Technical summary

CVE-2026-43735 is a cross-origin data exfiltration vulnerability (CWE-352: Cross-Site Request Forgery) affecting Apple's WebKit engine across multiple platforms. The vulnerability allows attackers to extract sensitive information across origin boundaries through improved security checks that were insufficient in affected versions. The vulnerability requires network access and user interaction but does not require authentication or elevated privileges. Apple has addressed the issue through patched releases across its ecosystem.

Business impact

Organizations relying on Apple devices for sensitive work face elevated risk of data theft. Users accessing corporate applications through Safari may have credentials, session tokens, or application data exposed to attackers operating malicious websites. The vulnerability affects employees across iPhones, iPads, Macs, and other Apple devices, potentially impacting remote workers and BYOD environments. Financial services, healthcare, and other data-sensitive sectors should prioritize remediation.

Affected systems

The vulnerability affects Safari, iOS, iPadOS, and macOS versions prior to the patched releases: Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Any user running an older version of these products is at risk. Apple Watch and Apple TV users are also affected, though the attack surface may be smaller depending on their web browsing usage.

Exploitability

Exploitation requires tricking a user into visiting a malicious website—a common attack vector achieved through phishing, malvertising, or social engineering. No advanced capabilities are needed beyond hosting a crafted website. The attack is immediately actionable once a user lands on the page and requires no additional clicks or user actions beyond the initial navigation. However, the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not yet been confirmed by U.S. government threat intelligence.

Remediation

Apply the patched versions immediately: Safari 26.5.2 or later, iOS 26.5.2 or later, iPadOS 26.5.2 or later, macOS Tahoe 26.5.2 or later, and tvOS/visionOS/watchOS 26.6 or later. For organizations managing fleets of Apple devices, deploy these updates through Mobile Device Management (MDM) platforms with mandatory update policies. Users should enable automatic security updates if available on their devices.

Patch guidance

Verify the exact patch version numbers against Apple's official security advisories before deploying. iOS, iPadOS, and Safari updates can be deployed via Over-The-Air (OTA) updates; macOS updates typically require restart. Consider staged rollouts to production environments to monitor for compatibility issues. Confirm successful patching by checking device Settings > General > About > Software Version (iOS/iPadOS) or System Settings > General > About > macOS Version for the expected build number.

Detection guidance

Monitor network logs for users visiting known malicious domains or phishing infrastructure. Endpoint detection and response (EDR) tools can flag Safari process anomalies during data exfiltration attempts, though the attack signature may be subtle. Web proxies and secure gateways should log and alert on access to suspicious domains. User reports of unexpected authentication failures or unauthorized account activity warrant investigation for potential data theft. Safari browser history review on suspected systems may reveal visits to previously unknown or anomalous websites.

Why prioritize this

This vulnerability combines high severity (CVSS 8.1) with easy exploitation requirements (network access and simple user interaction) and broad platform impact across personal and enterprise-managed Apple devices. The data exfiltration capability directly threatens confidentiality of corporate and personal information. While not yet in the KEV catalog, the simplicity of exploitation and user-facing nature of Safari makes it a strong candidate for active exploitation. Organizations with significant Apple device adoption should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects high impact to confidentiality and integrity, network-based attack vector, low attack complexity, no privilege requirement, and required user interaction. The score does not account for widespread availability of Apple devices or potential for mass exploitation via malvertising networks, which could elevate real-world risk beyond the base score in targeted or broad campaigns.

Frequently asked questions