CVE-2025-43529: Apple WebKit use-after-free allows code execution via crafted web content

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability, no privileges required, and confirmed KEV listing plus a vendor report of exploitation in targeted attacks.

What it is

A use-after-free flaw in Apple's WebKit engine was fixed through improved memory management across Safari, iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Processing maliciously crafted web content can lead to arbitrary code execution, and Apple states it is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 26.

Impact

An attacker who gets a victim to load crafted web content can achieve arbitrary code execution in the context of the affected component, potentially leading to full compromise of the device.

Attack surface

The flaw is reachable over the network through web content rendering, requiring no privileges but requiring user interaction (UI:R) for the victim to load the malicious content. No authentication is needed.

Exploitation

The vulnerability is listed in CISA KEV with a due date of 2026-01-05, and Apple reports it may have been exploited in targeted attacks; EPSS 30-day probability is 0.08763 (94.9th percentile). No ransomware campaign use is documented.

What to do

• Update to the fixed versions: Safari 26.2, iOS 18.7.3/iPadOS 18.7.3, iOS 26.2/iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2.
• Prioritize patching for devices used by targeted or high-risk individuals, since exploitation has been reported against specific targets.
• Follow CISA KEV required actions and BOD 22-01 guidance; discontinue use of affected products if mitigations are unavailable.
• Reduce exposure by restricting untrusted web browsing on unpatched devices until updates are applied.

Detection

• Monitor for crashes or memory corruption indicators in WebKit/Safari processes on unpatched Apple devices.
• Hunt for exploitation attempts or anomalous web content delivery targeting high-risk users, consistent with the reported targeted attack pattern.
• Track asset inventory against the fixed OS and browser versions to identify unpatched endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.