CVE-2025-43536: Apple Safari Use-After-Free Vulnerability

CVE-2025-43536 Overview

CVE-2025-43536 is a use-after-free vulnerability [CWE-416] affecting Apple Safari and multiple Apple operating systems. Processing maliciously crafted web content may lead to an unexpected process crash. Apple addressed the flaw with improved memory management in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, and macOS Tahoe 26.2. The vulnerability requires user interaction, as a victim must load attacker-controlled web content in a vulnerable Safari or WebKit-based context.

Critical Impact
Attackers can trigger a process crash by luring users to malicious web content, resulting in a denial-of-service condition against the browser process.

Affected Products

Apple Safari (prior to 26.2)
Apple iOS and iPadOS (prior to 18.7.3 and 26.2)
Apple macOS Tahoe (prior to 26.2)

Discovery Timeline

2025-12-17 - CVE-2025-43536 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43536

Vulnerability Analysis

The issue is a use-after-free condition in Apple's web content processing stack. A use-after-free occurs when code continues to reference memory that has already been freed, allowing subsequent operations to act on stale or reallocated data. In browser engines such as WebKit, these flaws typically emerge from complex object lifetime management across DOM, JavaScript, and rendering subsystems. Apple's advisories describe the root cause as insufficient memory management and confirm the fix applies improved handling of object lifetimes.

The practical impact defined in the advisory is limited to an unexpected process crash. The Availability impact is Low, while Confidentiality and Integrity are unaffected. Use-after-free defects in WebKit have historically served as building blocks for more severe exploitation chains, but no exploit is publicly available for this specific issue and it is not listed in the CISA KEV catalog.

Root Cause

The defect stems from improper tracking of object lifetimes inside the affected web content component. When a referenced object is deallocated but a dangling pointer remains reachable, subsequent access dereferences freed memory. Apple's remediation notes point to improved memory management as the corrective control.

Attack Vector

Exploitation requires a user to load attacker-controlled web content in Safari or another WebKit-backed view. The attack is network-reachable and requires user interaction. No authentication or elevated privileges are required on the target device.

The vulnerability manifests when maliciously crafted web content
triggers access to a freed object in the WebKit rendering pipeline.
See Apple's security advisories for component-level details.

Detection Methods for CVE-2025-43536

Indicators of Compromise

Repeated or unexplained Safari or WebKit process crashes coinciding with visits to specific URLs.
Crash reports on iOS, iPadOS, or macOS referencing com.apple.WebKit processes with memory access violations.
Outbound connections from managed devices to newly registered or low-reputation domains immediately preceding browser instability.

Detection Strategies

Collect and correlate macOS DiagnosticReports and MDM-forwarded iOS crash logs to identify WebKit termination patterns.
Monitor endpoint telemetry for abnormal Safari child process restarts on hosts running versions below Safari 26.2.
Use URL and DNS telemetry to flag browsing sessions preceding WebKit crashes for retrospective analysis.

Monitoring Recommendations

Track Apple software inventory in asset management to identify endpoints still running vulnerable OS builds.
Alert on repeated WebContent process exits with signal codes indicative of memory corruption.
Baseline normal Safari process behavior so anomalous crash clusters trigger investigation.

How to Mitigate CVE-2025-43536

Immediate Actions Required

Update Safari to version 26.2 on macOS endpoints where the browser is installed independently of the OS.
Upgrade iOS and iPadOS devices to 18.7.3 or 26.2, depending on the device's supported release train.
Upgrade macOS Tahoe systems to 26.2 to receive the corresponding WebKit fix.
Enforce patch compliance through MDM policies and block non-compliant devices from sensitive resources until remediated.

Patch Information

Apple published fixes across four advisories covering Safari, iOS/iPadOS 18.7.3, iOS/iPadOS 26.2, and macOS Tahoe 26.2. Refer to the Apple Security Advisory #125884, Apple Security Advisory #125885, Apple Security Advisory #125886, and Apple Security Advisory #125892 for version details and download instructions.

Workarounds

Restrict use of Safari on unpatched devices and route web traffic through a hardened alternative browser where feasible.
Apply web filtering and DNS controls to block access to untrusted or unclassified web content on vulnerable endpoints.
Enable Lockdown Mode on high-risk iOS, iPadOS, and macOS devices to reduce WebKit attack surface until patches are applied.

bash

# Verify Safari version on macOS
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Query macOS build to confirm Tahoe 26.2 is installed
sw_vers -productVersion