CVE-2026-43700 Overview
CVE-2026-43700 is a cross-origin vulnerability affecting Apple Safari, iOS, iPadOS, and macOS Tahoe. The flaw stems from improper tracking of security origins [CWE-346], allowing maliciously crafted web content to bypass the same-origin policy. An attacker who convinces a user to visit a malicious page can disclose sensitive user information from other origins.
Apple addressed the issue with improved tracking of security origins in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.
Critical Impact
Processing maliciously crafted web content may disclose sensitive user information across origin boundaries, undermining browser isolation guarantees.
Affected Products
- Apple Safari (prior to 26.5.2)
- Apple iOS and iPadOS (prior to 26.5.2)
- Apple macOS Tahoe (prior to 26.5.2)
Discovery Timeline
- 2026-06-29 - CVE-2026-43700 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-43700
Vulnerability Analysis
The vulnerability resides in how Safari and the underlying WebKit-based rendering stack track security origins across navigations and cross-origin interactions. Security origins are the fundamental trust boundary in browsers, combining scheme, host, and port to isolate one site's data from another. When origin tracking is imprecise, content loaded from one origin can access resources or state that should belong to another.
Exploitation requires user interaction, such as visiting an attacker-controlled web page or opening a link. Once loaded, the malicious content triggers the flawed origin-tracking logic to read data that the same-origin policy should protect. The result is disclosure of sensitive information — potentially including cross-origin response bodies, DOM state, or authenticated user context — without affecting integrity or availability.
Root Cause
The root cause is classified under [CWE-346] Origin Validation Error. The browser fails to consistently associate loaded content with its correct security origin during specific navigation or resource-loading sequences. Apple's advisory notes the issue was addressed with improved tracking of security origins, indicating the fix tightens the internal bookkeeping that ties document contexts to their originating scheme, host, and port.
Attack Vector
The attack is network-based and requires the victim to render attacker-controlled web content. No authentication or elevated privileges are needed on the target device. A typical scenario involves phishing links, malicious advertisements, or compromised legitimate sites embedding the crafted payload. Successful exploitation leaks confidential data from other origins the user has active sessions with, such as webmail, cloud storage, or SaaS dashboards.
Detection Methods for CVE-2026-43700
Indicators of Compromise
- Safari, iOS, iPadOS, or macOS clients running versions earlier than 26.5.2 that browse untrusted content.
- Web server logs showing cross-origin fetches or navigations originating from unexpected referrers or embedded frames.
- Outbound connections from browser processes to newly registered or low-reputation domains immediately following user link-clicks.
Detection Strategies
- Inventory Apple endpoints and mobile devices to identify Safari, iOS, iPadOS, and macOS versions below 26.5.2.
- Monitor proxy and DNS telemetry for user traffic to domains associated with phishing or malvertising campaigns targeting Apple browsers.
- Correlate browser process behavior with subsequent access to sensitive internal web applications for signs of session data misuse.
Monitoring Recommendations
- Enable browser telemetry forwarding to a centralized data lake and alert on anomalous cross-origin request patterns.
- Track user-agent strings on internal applications to identify unpatched Apple client versions accessing sensitive resources.
- Review authentication logs for session reuse from unexpected IP addresses that may indicate leaked credentials or tokens.
How to Mitigate CVE-2026-43700
Immediate Actions Required
- Update Safari to 26.5.2 on all macOS devices.
- Update iOS and iPadOS devices to 26.5.2 through Software Update or mobile device management (MDM).
- Update macOS Tahoe endpoints to 26.5.2 and validate patch deployment across the fleet.
- Educate users to avoid clicking untrusted links until patching is confirmed.
Patch Information
Apple released fixes in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Refer to the vendor advisories for full details: Apple Support Document #127594, Apple Support Document #127595, and Apple Support Document #127685.
Workarounds
- Restrict Safari usage on unpatched devices and direct users to an alternate, up-to-date browser where feasible.
- Enforce enterprise web filtering to block known malicious and low-reputation domains at the network edge.
- Require re-authentication and short session lifetimes on sensitive web applications to limit the value of leaked data.
# Verify Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app
# Trigger managed software update via MDM (example: Jamf)
sudo jamf policy -event install-apple-updates
# Check macOS build version
sw_vers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
