CVE-2025-43529

What it actually does

This is a WebKit use-after-free vulnerability affecting Apple platforms that process web content through Safari or embedded WebKit views. A use-after-free occurs when memory is released but later reused by the program; with carefully crafted web content, an attacker can corrupt memory and execute arbitrary code in the context of the vulnerable browser or web-content process. The CVSS vector indicates network reachability, no authentication requirement, and user interaction required, with high confidentiality, integrity, and availability impact. Because Apple reports exploitation in highly sophisticated targeted attacks against specific individuals on iOS versions before iOS 26, this should be treated as an actively exploited browser engine code-execution vulnerability rather than a theoretical crash bug.

Why it matters to the business

Successful exploitation can allow spyware, credential theft, session hijacking, surveillance, data exfiltration, or installation of additional payloads on affected Apple devices after a user visits or is redirected to malicious web content. The highest-risk populations are executives, legal teams, journalists, administrators, developers, mobile users handling sensitive data, and personnel likely to be targeted by advanced threat actors. The issue is listed in CISA KEV with a remediation due date of 2026-01-05, meaning regulated or federal-facing programs may have explicit patch timelines. Although it is not currently marked as used in ransomware campaigns, active in-the-wild exploitation and broad Apple ecosystem exposure make rapid remediation operationally important.

How an attack unfolds

An attacker prepares malicious web content that triggers the WebKit use-after-free condition. The victim is then induced to open the content through Safari, an in-app browser, a malicious link, a compromised legitimate site, an advertisement, a message preview, or another component that renders WebKit content. When the content is processed, the attacker manipulates freed memory so execution flow is redirected to attacker-controlled code. In a mature exploit chain, this browser-code-execution primitive may be paired with sandbox escape, privilege escalation, or persistence techniques to access device data beyond the web content process. Apple has reported exploitation in extremely sophisticated targeted attacks against specific individuals on pre-iOS 26 versions, and related reporting also references CVE-2025-14174, so defenders should consider this part of a targeted WebKit exploitation cluster rather than an isolated commodity browser crash.

How to fix it

Apply Apple security updates immediately across all affected products. Fixed releases identified by Apple are Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2. Prioritize iPhones and iPads, especially devices running iOS versions before iOS 26 or used by high-risk personnel. Where immediate patching is not possible, reduce exposure by restricting access to untrusted web content, disabling or limiting JavaScript where operationally feasible, using managed browser controls, blocking newly registered or suspicious domains, enforcing safe-link rewriting, and isolating high-risk browsing activity. Mitigations should be treated as temporary because browser memory-corruption vulnerabilities are often reliably exploitable once mature exploit chains exist.

How to confirm the fix worked

Confirm that all affected Apple devices and Safari installations report versions at or above the fixed releases: Safari 26.2, iOS/iPadOS 18.7.3, iOS/iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2. Validate through MDM inventory, endpoint management, software update status, and device compliance policies rather than relying on user attestation. For iOS and iPadOS, verify both OS version and security response/update state. Test that patch compliance rules flag older versions as noncompliant. For exposure assessment, identify devices capable of rendering WebKit content, including Safari and applications with embedded web views, and confirm they have received the underlying Apple platform update.

Typical attack path

1. Identify targets using vulnerable Apple devices or browsers, especially iOS versions before iOS 26 and unpatched Safari/macOS/iPadOS/tvOS/visionOS/watchOS installations.
2. Host or inject maliciously crafted web content designed to trigger the WebKit use-after-free condition.
3. Deliver the content through spear-phishing, SMS/iMessage, email links, watering-hole sites, malvertising, compromised websites, or embedded web views inside apps.
4. Wait for the target to open or preview the content, causing WebKit to parse and process the malicious page.
5. Trigger memory corruption and gain arbitrary code execution in the browser or web-content process.
6. Optionally chain with additional vulnerabilities to escape sandboxing, elevate privileges, deploy spyware, steal tokens, or access sensitive local data.
7. Remove infrastructure, rotate domains, or use one-time payloads to reduce forensic evidence.

How to detect it

Detection is difficult because successful WebKit memory-corruption exploitation may occur entirely through browser content and sophisticated attackers often use short-lived infrastructure. Review Apple endpoint telemetry, MDM records, EDR events, unified logs, crash reports, DNS logs, proxy logs, secure web gateway logs, email security logs, and messaging/link-click telemetry for activity involving suspicious or targeted web content before devices were patched. Look for Safari or WebKit process crashes followed by unusual network connections, new or modified configuration profiles, unexpected device management enrollment, unknown VPN/proxy settings, abnormal background processes, credential prompts, suspicious downloads, or signs of spyware-like behavior. On macOS, examine Unified Logging, Safari/WebKit crash reports, quarantine events, launch agents, launch daemons, login items, browser history, and network telemetry. On iOS/iPadOS, rely heavily on MDM inventory, device analytics logs if available, mobile threat defense telemetry, DNS/proxy records, and forensic tooling for high-risk users. Pay special attention to activity associated with reported threat context including DarkSword and related WebKit exploitation campaigns. Absence of crashes or logs does not rule out exploitation, especially for targeted mobile spyware operations.

What your security team should do

• Treat this as urgent because it is actively exploited in the wild and is listed in CISA KEV with a 2026-01-05 remediation deadline.
• Patch all affected Apple products to the fixed versions, prioritizing iPhone, iPad, Safari, and macOS systems used by high-risk or privileged users.
• Use MDM or endpoint inventory to produce a daily list of devices below the fixed versions until remediation is complete.
• Hunt for signs of targeted browser exploitation, suspicious redirects, unknown profiles, unexpected VPN or proxy configuration changes, abnormal device management enrollment, and post-exploitation activity on Apple endpoints.
• Review web proxy, DNS, email security, messaging, and EDR telemetry for suspicious links opened by high-risk users around the period before patching.
• Consider enhanced monitoring or forensic triage for individuals who may be targeted by advanced threat actors such as those associated with DarkSword or related WebKit exploitation campaigns.
• Where patching is delayed, temporarily restrict access to untrusted web content and increase protections for high-risk browsing, but do not consider these controls equivalent to applying Apple updates.
• Communicate to users that unexpected links or message previews may be risky until devices are updated, while avoiding reliance on user behavior as the primary control.