CVE-2026-43699: Apple Safari Use-After-Free Vulnerability

CVE-2026-43699 Overview

CVE-2026-43699 is a use-after-free vulnerability [CWE-416] affecting Apple Safari, iOS, iPadOS, and macOS. Processing maliciously crafted web content may lead to an unexpected process crash. Apple addressed the issue through improved memory management in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.

The vulnerability requires user interaction, as a target must visit or render attacker-controlled web content. Successful exploitation impacts availability but does not directly compromise confidentiality or integrity.

Critical Impact
Remote attackers can trigger a process crash on affected Apple devices by luring users to malicious web pages, producing denial-of-service conditions in the browser and system components that render web content.

Affected Products

Apple Safari (prior to 26.5.2)
Apple iOS and iPadOS (prior to 26.5.2)
Apple macOS Tahoe (prior to 26.5.2)

Discovery Timeline

2026-06-29 - CVE-2026-43699 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-43699

Vulnerability Analysis

The flaw is a use-after-free condition triggered by processing maliciously crafted web content. Use-after-free defects arise when code continues to reference a memory region after it has been freed, allowing that memory to be reused for unrelated data. When the stale pointer is dereferenced, the process may crash or execute code paths against attacker-influenced memory.

Apple describes the fix as improved memory management, indicating the object lifetime and reference handling in the affected component were revised. The reachable outcome documented by Apple is an unexpected process crash rather than code execution.

The attack proceeds over the network with low complexity and no privileges, but requires user interaction to load the crafted content. Because Safari and the underlying WebKit engine render content across iOS, iPadOS, and macOS, the same defect class affects each platform.

EPSS data reports a probability of 0.24% with a percentile of 15.031, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper memory lifetime management [CWE-416] in the web content rendering path. A referenced object is released while another code path retains a pointer to it, leading to a dangling reference that is later dereferenced during rendering.

Attack Vector

An attacker hosts crafted web content on a page under their control or delivered through a compromised site, advertisement, or embedded frame. When a user visits the page in a vulnerable Safari or WebKit-based view, the rendering process triggers the freed-object reuse and crashes. No authentication is required, but user interaction is necessary to load the content.

No public proof-of-concept, exploit, or in-the-wild exploitation has been reported for CVE-2026-43699.

Detection Methods for CVE-2026-43699

Indicators of Compromise

Repeated or unexpected Safari or WebKit renderer crashes recorded in system diagnostic logs shortly after visiting untrusted web pages.
Crash reports referencing WebKit content processes with memory access violations following navigation events.
User reports of Safari tab or application termination correlated with specific URLs or ad networks.

Detection Strategies

Monitor macOS DiagnosticReports and iOS crash telemetry for WebKit and Safari process terminations that cluster around specific domains or content types.
Correlate proxy or DNS logs with browser crash events to identify domains delivering the triggering content.
Track endpoint versions against Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 to enumerate exposed assets.

Monitoring Recommendations

Ingest Apple endpoint telemetry and browser crash data into a centralized analytics platform for pattern analysis.
Alert on abnormal rates of renderer crashes across the fleet, which may indicate targeted delivery of malicious content.
Review web proxy category filtering to reduce exposure to newly registered or low-reputation domains.

How to Mitigate CVE-2026-43699

Immediate Actions Required

Update Safari to version 26.5.2 on macOS endpoints without a full OS upgrade requirement.
Update iPhone and iPad devices to iOS 26.5.2 and iPadOS 26.5.2 through mobile device management or user-driven updates.
Update Mac systems to macOS Tahoe 26.5.2 to remediate the WebKit component system-wide.
Advise users to avoid clicking untrusted links until affected devices are patched.

Patch Information

Apple published fixes in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Details are available in the Apple Support Advisory #127594, Apple Support Advisory #127595, and Apple Support Advisory #127685.

Workarounds

Restrict browsing to trusted sites and enable content filtering at the network layer until patches are deployed.
Enforce Lockdown Mode on high-risk iOS, iPadOS, and macOS accounts to reduce the WebKit attack surface.
Block or sandbox third-party WebKit-based applications that render arbitrary content on unpatched devices.

bash

# Verify installed Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Verify macOS build version
sw_vers

# Trigger managed software update via MDM tooling (example)
sudo softwareupdate --install --all --restart