CVE-2026-43746: Safari Use-After-Free Memory Flaw

Technical summary

CVE-2026-43746 is a use-after-free vulnerability (CWE-416) in Apple's Safari browser and bundled WebKit components. Use-after-free occurs when freed memory is accessed again, leading to unpredictable behavior. In this case, maliciously crafted web content triggers the flaw during parsing or rendering, causing Safari to crash. The vulnerability requires network-level attack surface (AV:N) and user interaction (UI:R)—the user must navigate to or be redirected to a malicious site. No authentication, special privileges, or system modification is needed. The impact scope is limited to availability (A:H), with no confidentiality or integrity risk. CVSS 3.1 score of 6.5 (Medium) reflects the moderate real-world threat posed by a relatively easy-to-exploit crash vulnerability paired with the requirement for user interaction.

Business impact

This vulnerability primarily threatens user experience and device uptime. Affected users (Safari on macOS Tahoe, iOS, or iPadOS) face unexpected browser crashes if they visit a compromised or attacker-controlled website. For organizations with BYOD policies or managed device fleets running unpatched Apple systems, widespread exploitation could degrade productivity through repeated browser instability. The lack of data exfiltration or privilege escalation limits the direct security blast radius, but persistent crashes from malicious sites could be weaponized for targeted harassment or disruption. Reputational risk exists if an organization's website is used to host exploits. Enterprise app publishers relying on Safari's WebKit rendering may also see user-facing stability issues if their sites trigger the flaw.

Affected systems

Safari on macOS Tahoe, iOS, and iPadOS are affected. The vulnerability exists in all versions prior to the 26.5.2 release series. Any Apple device running an older Safari, iOS, or iPadOS version is at risk. Desktop users on macOS Tahoe before 26.5.2, iPhone users on iOS before 26.5.2, and iPad users on iPadOS before 26.5.2 should be considered vulnerable. Third-party browsers on iOS and iPadOS that use the system WebKit engine may also be affected, depending on their update status and Apple's component versioning.

Exploitability

Exploitation is relatively straightforward—it requires only hosting malicious web content and inducing a user to visit it via social engineering, search result manipulation, or network interception. The attack is unauthenticated and requires no local access. The barrier to weaponization is the need for user interaction; the attacker cannot directly trigger the crash from the network alone. No public exploit code is currently tracked in the CISA KEV catalog (KEV status: false), and the vulnerability was not designated as actively exploited in the wild at publication. However, the simplicity of the attack vector and low barrier to proof-of-concept development suggest that motivated threat actors could relatively quickly develop reliable crash exploits for targeted campaigns or malware delivery.

Remediation

Apple has released patches in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Organizations should prioritize patching across their user base. For managed device environments, push updates via mobile device management (MDM) platforms. For consumer users, enable automatic updates in Safari and iOS/iPadOS settings. Verify patch compliance by checking installed versions in device settings (Settings > General > About on iOS/iPadOS, System Settings > General > About on macOS).

Patch guidance

Apply the following updates as soon as feasible: Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. For enterprise environments, test patches on a representative subset of devices before wide deployment to rule out compatibility issues with legacy applications. Prioritize user-facing client devices and employee-owned devices with high web browsing activity. Configure automatic updates where policy allows to reduce manual patching overhead. Verify that third-party apps bundled with Safari or relying on WebKit rendering have also been updated, as they may ship their own WebKit binaries.

Detection guidance

Monitor for sudden spikes in Safari crash reports in telemetry systems; a distributed surge may indicate active exploitation. Endpoint detection and response (EDR) tools can track Safari process termination events, though benign crashes will generate noise. Network-based detection is challenging because the trigger is content-based; however, blocking known malicious web domains reduces exposure. Implement web filtering or content security policies to limit access to high-risk sites. Review user browsing logs for unexpected navigation to unfamiliar or suspicious domains immediately before reported crashes. Consider deploying browser isolation solutions in high-risk environments to sandboxe rendering of untrusted content.

Why prioritize this

This vulnerability warrants medium-priority remediation. While the CVSS score of 6.5 is moderate, the combination of low attack complexity, no user privilege requirements, and simplicity of weaponization means patching should occur in the near term (days to weeks, not months). The lack of active KEV designation and current real-world exploitation reduces urgency relative to critical or high-severity flaws, but the wide installed base of Safari and iOS devices means exposure is substantial. Organizations should prioritize this in a normal patching cycle, ahead of low-severity issues but below critical vulnerabilities affecting authentication, encryption, or data access.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium severity) is justified by: (1) Network-accessible attack surface with no special privileges required (AV:N, PR:N); (2) Low attack complexity—the malicious content simply needs to be processed by the browser (AC:L); (3) Required user interaction—the user must navigate to the malicious site (UI:R); (4) High availability impact—the crash denies browser service (A:H); (5) Zero confidentiality or integrity impact (C:N, I:N), limiting the severity ceiling. The score accurately reflects a denial-of-service threat that is relatively easy to trigger but limited in damage scope. Actual risk in any given environment depends on user behavior, web filtering policies, and patch deployment speed.

Frequently asked questions