CVE-2026-43704: Apple Safari Use-After-Free Vulnerability

CVE-2026-43704 Overview

CVE-2026-43704 is a use-after-free vulnerability [CWE-416] affecting Apple Safari, iOS, iPadOS, and macOS Tahoe. A malicious web extension can trigger an unexpected process crash by exploiting improper memory management in the affected components. Apple addressed the issue through improved memory management in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.

The flaw carries a CVSS 3.1 score of 5.3 and requires user interaction to be triggered. Exploitation impacts availability but does not compromise confidentiality or integrity. No public proof-of-concept exists, and CISA has not added this CVE to its Known Exploited Vulnerabilities catalog.

Critical Impact
A malicious web extension may be able to cause an unexpected process crash on affected Apple platforms, resulting in denial of service to the browser process.

Affected Products

Apple Safari (versions prior to 26.5.2)
Apple iOS and iPadOS (versions prior to 26.5.2)
Apple macOS Tahoe (versions prior to 26.5.2)

Discovery Timeline

2026-06-29 - CVE-2026-43704 published to the National Vulnerability Database (NVD)
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-43704

Vulnerability Analysis

CVE-2026-43704 is a use-after-free memory corruption issue within the web extension handling logic of Apple's WebKit-based browser stack. Use-after-free conditions arise when a program continues to reference memory after it has been released, allowing attackers to manipulate the freed region to influence process behavior.

In this case, the vulnerable code path is reachable through a malicious web extension. When the extension performs a specific sequence of operations, the browser process accesses a dangling pointer to previously freed memory. The result is an unexpected process crash and denial of service to the browser session.

Exploitation requires user interaction, meaning the victim must install or activate the malicious extension. The attack complexity is high, indicating that reliable triggering depends on timing or environmental conditions.

Root Cause

The root cause is improper memory lifecycle management within the extension processing subsystem. An object reference persists after its underlying memory has been deallocated. Apple resolved the defect with improved memory management, tightening the object lifetime tracking so freed memory cannot be re-accessed.

Attack Vector

The attack originates from a malicious web extension distributed to the victim. Once loaded, the extension executes code that reaches the vulnerable path in the browser or operating system component. Because user interaction is required, the attacker relies on social engineering or supply-chain compromise of a legitimate extension. Successful exploitation crashes the affected process, which impacts availability without leaking data or altering system state.

See the Apple Support Advisory #127594 for vendor technical details.

Detection Methods for CVE-2026-43704

Indicators of Compromise

Unexpected Safari, WebKit, or com.apple.WebKit.WebContent process crashes recorded in system diagnostic reports
Presence of unsigned or unverified Safari web extensions installed from outside the App Store
Repeated crash logs in ~/Library/Logs/DiagnosticReports/ referencing WebKit or extension-related frames

Detection Strategies

Inventory installed Safari web extensions across managed macOS and iOS devices using MDM telemetry
Correlate browser process crash events with recent extension installations or updates
Monitor endpoint logs for abnormal termination signals affecting Safari and WebKit helper processes

Monitoring Recommendations

Enable centralized collection of macOS unified logs and iOS crash reports for security review
Alert on installation of Safari extensions that lack notarization or are sideloaded through developer profiles
Track version compliance to confirm endpoints are running Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, or macOS Tahoe 26.5.2 or later

How to Mitigate CVE-2026-43704

Immediate Actions Required

Update all Apple devices to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, or macOS Tahoe 26.5.2 without delay
Audit installed Safari web extensions and remove any that are unnecessary, unsigned, or from untrusted publishers
Enforce automatic security updates through MDM policy for iOS, iPadOS, and macOS fleets

Patch Information

Apple has released fixes in the following updates: Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Refer to Apple Support Advisory #127594, Apple Support Advisory #127595, and Apple Support Advisory #127685 for release notes and download instructions.

Workarounds

Disable or remove all non-essential Safari web extensions until patches are applied
Restrict extension installation to organizationally approved sources through MDM configuration profiles
Educate users to avoid installing browser extensions from unverified developers or third-party websites

bash

# Verify installed Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# List installed Safari extensions on macOS
pluginkit -mAvvv -p com.apple.Safari.extension