CVE-2025-43421: Apple Safari DOS Vulnerability

CVE-2025-43421 Overview

CVE-2025-43421 is a WebKit vulnerability affecting Apple Safari, iOS, iPadOS, macOS, and visionOS. Processing maliciously crafted web content may lead to an unexpected process crash. Apple addressed the issue by disabling array allocation sinking, an optimization in the JavaScriptCore engine. The flaw is classified as an out-of-bounds read [CWE-125] and requires user interaction, such as visiting an attacker-controlled webpage. Apple shipped fixes in Safari 26.1, iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, and visionOS 26.1.

Critical Impact
Remote attackers can trigger a denial-of-service condition in Safari and other WebKit-based applications by luring users to malicious web content.

Affected Products

Apple Safari (prior to 26.1)
Apple iOS and iPadOS (prior to 26.1)
Apple macOS Tahoe (prior to 26.1)
Apple visionOS (prior to 26.1)

Discovery Timeline

2025-11-04 - CVE-2025-43421 published to the National Vulnerability Database
2025-11-04 - Apple releases security advisories referencing Safari 26.1, iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, and visionOS 26.1
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43421

Vulnerability Analysis

The vulnerability resides in WebKit, the browser engine used by Safari and other Apple platform components. Apple's advisory groups this issue with several others addressed by disabling array allocation sinking in the JavaScriptCore just-in-time (JIT) compiler. Array allocation sinking is an optimization that delays or moves array object allocations to reduce heap pressure. When the optimization interacts incorrectly with speculative code paths, the engine can read memory outside intended bounds, producing an out-of-bounds read [CWE-125].

Exploitation requires the target to load attacker-controlled web content. The primary observed impact is a process crash inside the WebContent (renderer) process. The vulnerability does not directly disclose data or grant code execution based on Apple's description, but crash conditions in JIT-compiled code are commonly investigated for further weaponization.

Root Cause

The root cause is an unsafe interaction in JavaScriptCore's array allocation sinking optimization. Under specific JavaScript object shape and control-flow patterns, the optimizer sinks allocations across paths where invariants no longer hold. Subsequent property or element access reads memory that was never validly initialized as an array backing store, producing the out-of-bounds condition.

Attack Vector

The attack vector is network-based through the browser. An attacker hosts crafted JavaScript on a web page or embeds it in an iframe, advertisement, or WebView. When the victim visits the page, WebKit compiles and executes the JavaScript, triggering the flawed optimization path and crashing the renderer. No authentication is required, and user interaction is limited to opening a link or resource.

No public proof-of-concept exploit is available. See the Apple Security Advisory #125634 for the vendor description.

Detection Methods for CVE-2025-43421

Indicators of Compromise

Repeated Safari or WebKit renderer process crashes tied to a specific URL or ad network
Crash reports in ~/Library/Logs/DiagnosticReports/ naming com.apple.WebKit.WebContent with signatures inside JavaScriptCore JIT code
Outbound connections from browser processes to newly registered or low-reputation domains preceding renderer crashes

Detection Strategies

Correlate endpoint telemetry for WebContent process terminations with the URLs loaded immediately prior
Monitor Safari and WebKit application versions across the fleet to identify hosts running builds earlier than 26.1
Ingest browser crash reports into centralized logging and alert on clusters of JavaScriptCore faults

Monitoring Recommendations

Track macOS, iOS, iPadOS, and visionOS OS build numbers via MDM inventory to confirm patch coverage
Alert on abnormal frequencies of WebContent restarts on individual endpoints, which may indicate exposure to malicious content
Review web proxy and DNS logs for user visits to domains hosting exploit-grade JavaScript payloads

How to Mitigate CVE-2025-43421

Immediate Actions Required

Update Safari to version 26.1 on supported macOS releases
Upgrade iOS and iPadOS devices to 26.1 through Software Update or MDM policies
Upgrade macOS to Tahoe 26.1 and visionOS devices to 26.1
Restart browsers and devices after patching to ensure the updated WebKit framework is loaded

Patch Information

Apple published fixes in the following advisories: Apple Security Advisory #125632, Apple Security Advisory #125634, Apple Security Advisory #125638, and Apple Security Advisory #125640. The patch disables array allocation sinking in JavaScriptCore, eliminating the unsafe optimization path.

Workarounds

Restrict browsing to trusted sites and block untrusted advertising networks at the web proxy
Enable Lockdown Mode on high-risk Apple devices to reduce JavaScript attack surface until patches are applied
Deploy MDM configuration profiles that enforce automatic OS and Safari updates

bash

# Verify Safari and OS versions on macOS
sw_vers
/Applications/Safari.app/Contents/MacOS/Safari --version 2>/dev/null || \
  defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString

# Trigger managed software update on macOS
sudo softwareupdate --install --all --restart