CVE-2026-43670: Apple Safari XSS Vulnerability

CVE-2026-43670 Overview

CVE-2026-43670 is a Content Security Policy (CSP) bypass vulnerability affecting Apple Safari and multiple Apple operating systems. The flaw resides in the enforcement of CSP directives within AudioWorklet contexts in WebKit. Processing maliciously crafted web content allows attackers to bypass Content Security Policy protections that would otherwise restrict script execution and resource loading. Apple addressed the issue with improved enforcement in AudioWorklet contexts. The vulnerability is categorized under [CWE-693] Protection Mechanism Failure.

Critical Impact
An attacker who lures a user to a malicious web page can bypass CSP restrictions, weakening a core browser defense-in-depth control that mitigates cross-site scripting and data exfiltration.

Affected Products

Apple Safari (versions prior to 26.5)
Apple iOS and iPadOS (versions prior to 18.7.9 and 26.5)
Apple macOS Tahoe (versions prior to 26.5)

Discovery Timeline

2026-08-25 - CVE-2026-43670 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-43670

Vulnerability Analysis

Content Security Policy is a browser security mechanism that restricts which sources of scripts, styles, and other resources a page may load. The vulnerability affects how WebKit enforces CSP directives inside AudioWorklet execution contexts. AudioWorklet allows web developers to run custom audio processing code on a dedicated real-time thread through JavaScript modules loaded via audioWorklet.addModule(). When CSP checks are not consistently applied to script resources loaded or executed within these worklet contexts, an attacker can execute code paths that a properly enforced policy would deny. This weakens the layered defense CSP provides against cross-site scripting and untrusted content injection.

Root Cause

The root cause is a protection mechanism failure [CWE-693] in WebKit's CSP enforcement layer. The AudioWorklet code path did not apply the same policy checks used by the main document context. Apple's advisories state the issue was resolved with improved enforcement in AudioWorklet contexts.

Attack Vector

Exploitation requires an attacker to host or inject malicious web content and convince a victim to visit the page. The attack proceeds over the network and requires user interaction, such as clicking a link. Once loaded, the malicious page uses crafted AudioWorklet module loading or messaging to run script or fetch content that CSP would normally block, undermining protections that sites rely on to contain injected code. No verified proof-of-concept code has been published.

Detection Methods for CVE-2026-43670

Indicators of Compromise

Safari or WebKit-based process activity involving audioWorklet.addModule() calls to unexpected external origins.
Web server or proxy logs showing worklet module fetches that violate the site's declared CSP script-src directive.
Browser console csp-report or report-to endpoints receiving anomalous violation reports tied to worklet script sources.

Detection Strategies

Deploy CSP reporting endpoints and monitor for reports referencing worklet or audio contexts on trusted origins.
Inventory Apple endpoints and identify systems still running Safari, iOS, iPadOS, or macOS versions below the patched builds.
Correlate browser telemetry with outbound network requests to unrecognized script hosts from Safari processes.

Monitoring Recommendations

Track patch compliance for Safari 26.5, iOS/iPadOS 18.7.9 and 26.5, and macOS Tahoe 26.5 across managed fleets.
Alert on newly observed script domains loaded from Safari on high-value user devices.
Review web application CSP violation logs for spikes originating from Safari user agents.

How to Mitigate CVE-2026-43670

Immediate Actions Required

Update Safari to version 26.5 on all supported macOS platforms.
Update iPhone and iPad devices to iOS 18.7.9, iPadOS 18.7.9, or iOS/iPadOS 26.5 as applicable to the hardware.
Update Mac systems running macOS Tahoe to version 26.5.
Push updates through mobile device management (MDM) to enforce compliance across managed Apple endpoints.

Patch Information

Apple released fixes in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, and macOS Tahoe 26.5. Full advisory details are published in Apple Support Article #127110, Apple Support Article #127111, Apple Support Article #127115, and Apple Support Article #127121.

Workarounds

Restrict browsing to trusted sites on unpatched Apple devices until updates are applied.
Tighten site-side CSP with strict script-src allowlists and require-trusted-types-for 'script' where feasible to reduce injection paths.
Route Safari traffic through a secure web gateway that blocks known malicious domains and inspects worklet module fetches.

bash

# Verify installed Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Check macOS build to confirm patch level
sw_vers

# Trigger software update check via CLI
sudo softwareupdate --list
sudo softwareupdate --install --all --restart