CVE-2026-43740: Apple Safari Memory Disclosure Vulnerability – Patch Guidance

Technical summary

CVE-2026-43740 is a memory safety issue (CWE-119, CWE-416) in Apple's WebKit engine that allows attackers to read process memory through maliciously crafted web content. The vulnerability exploits inadequate bounds checking and potential use-after-free conditions in memory handling routines. An attacker hosting or injecting malicious HTML/JavaScript can trigger the vulnerability when a user navigates to or loads the content in Safari or WebKit-based browsers on affected platforms. The memory disclosure is direct—no additional exploitation steps are required once the malicious content is processed.

Business impact

This vulnerability exposes confidential data resident in browser process memory, which may include cached credentials, session tokens, personal information, or other sensitive application state. Organizations with employees using affected Apple devices face data exfiltration risk, particularly in bring-your-own-device (BYOD) environments or where Safari is the primary browser. The impact is heightened for users who visit untrusted websites or follow phishing links. However, the attack does not enable code execution or system compromise, limiting the scope of downstream damage.

Affected systems

Safari 26.5.1 and earlier; iOS 26.5.1 and earlier; iPadOS 26.5.1 and earlier; macOS Tahoe 26.5.1 and earlier; tvOS 26.5 and earlier; visionOS 26.5 and earlier; watchOS 26.5 and earlier. All major Apple consumer platforms are affected. Enterprise users relying on Safari for internal web applications or users on macOS for development work should prioritize patching.

Exploitability

Exploitability is straightforward from a technical standpoint: an attacker needs only to craft malicious web content and convince or trick a user into visiting it. No special network access, elevated privileges, or complex exploitation chains are required. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects network-accessible, low-complexity exploitation with a single user interaction barrier. However, the vulnerability is not currently tracked in CISA's KEV catalog, indicating no known public exploits as of the last update. Threat actors could develop exploits relatively easily once the attack surface is understood.

Remediation

Apply the latest patches immediately: Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Apple released these fixes on a coordinated schedule post-disclosure. Enable automatic updates where possible to reduce deployment friction. Verify patch deployment via device inventory management tools, particularly for BYOD environments where user compliance may vary.

Patch guidance

For macOS users: Install macOS Tahoe 26.5.2 or later via System Settings > General > Software Update. For iOS/iPadOS: Update via Settings > General > Software Update. For tvOS, visionOS, and watchOS, use their respective Settings apps. Enterprise IT teams should use Mobile Device Management (MDM) solutions to enforce updates across fleet. Verify patch status by checking System Information or Settings > About. Document patch deployment dates for compliance reporting. If you are running any version listed in affected_systems_summary, you should patch within 24–48 hours.

Detection guidance

Monitor for suspicious web content access patterns and unexpected memory disclosure anomalies via endpoint detection and response (EDR) tools. Safari process crashes or unusual memory access behavior may indicate exploitation attempts, though detection is difficult without host-based telemetry. Network-level detection is limited; inspect web proxy logs for visits to known malicious domains. Educate users to avoid clicking untrusted links and to keep browsers updated. Organizations using managed Safari configurations should verify that content blockers and domain-allow-listing policies are in place.

Why prioritize this

Although untracked in KEV and marked MEDIUM severity, this vulnerability warrants near-immediate patching because: (1) it is trivially exploitable via web browsing, a universal user behavior; (2) it affects all major Apple consumer and professional platforms; (3) memory disclosure can compromise session tokens, credentials, and personal data; (4) affected users often do not realize they are at risk until patched. Organizations with significant macOS, iOS, or iPadOS deployment should treat this as HIGH priority operationally despite the MEDIUM CVSS score.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects high confidentiality impact (C:H) offset by the requirement for user interaction (UI:R) and lack of integrity or availability impact (I:N, A:N). The network-accessible attack vector (AV:N) and low complexity (AC:L) elevate the score. The score appropriately captures the memory disclosure risk but may underweight the practical threat given the ease of exploitation and universal attack surface (web browsing). Security teams should apply organizational risk context—if memory disclosure can compromise credentials or personal data in your environment, internal risk rating should exceed the CVSS number.

Frequently asked questions