CVE-2026-43717: Apple Safari Use-After-Free Vulnerability

CVE-2026-43717 Overview

CVE-2026-43717 is a use-after-free vulnerability [CWE-416] affecting Apple Safari and the underlying web content processing components in iOS, iPadOS, and macOS. Processing maliciously crafted web content triggers memory that has already been freed, resulting in an unexpected Safari crash. Apple addressed the flaw with improved memory management in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. The vulnerability requires user interaction, such as visiting an attacker-controlled webpage, and impacts availability without compromising confidentiality or integrity.

Critical Impact
Remote attackers can crash Safari on unpatched Apple devices by luring users to malicious web content, disrupting browsing sessions across iPhone, iPad, and Mac endpoints.

Affected Products

Apple Safari (versions prior to 26.5.2)
Apple iOS and iPadOS (versions prior to 26.5.2)
Apple macOS Tahoe (versions prior to 26.5.2)

Discovery Timeline

2026-06-29 - CVE-2026-43717 published to the National Vulnerability Database
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-43717

Vulnerability Analysis

The vulnerability is a use-after-free condition triggered during the processing of web content. A use-after-free occurs when a program continues to reference memory after it has been released back to the allocator. Attackers who influence allocator state can reclaim the freed region with attacker-controlled data before the dangling reference is dereferenced.

In this case, exploitation requires a user to load malicious web content in an affected Apple browser or WebKit-backed view. The observed outcome documented by Apple is an unexpected Safari crash, indicating a high availability impact. The flaw is network-reachable, requires low attack complexity, and needs no privileges beyond user interaction.

Root Cause

Apple attributes the defect to insufficient lifetime tracking of an object referenced during web content processing. The remediation notes describe the fix as "improved memory management," which typically involves stronger reference counting, ownership transfers, or defensive nulling of pointers after free. The underlying weakness maps to CWE-416, Use After Free.

Attack Vector

An attacker hosts crafted HTML, JavaScript, or related web assets on a page under their control. When a victim visits the page in an unpatched version of Safari on iOS, iPadOS, or macOS, the browser reaches the vulnerable code path and dereferences freed memory. The result is a process crash. Because the CVSS vector reports no confidentiality or integrity impact, public data does not indicate reliable code execution from this specific issue, though use-after-free classes of bugs frequently receive further exploitation research.

No verified public proof-of-concept code is available. For technical specifics, consult the Apple Support Article #127594, Apple Support Article #127595, and Apple Support Article #127685.

Detection Methods for CVE-2026-43717

Indicators of Compromise

Repeated or unexpected Safari process crashes (com.apple.Safari, WebContent, com.apple.WebKit.WebContent) shortly after visiting untrusted URLs.
Crash reports in ~/Library/Logs/DiagnosticReports/ on macOS or device analytics on iOS referencing WebKit memory faults such as EXC_BAD_ACCESS on freed objects.
Browser navigation logs showing visits to unfamiliar domains immediately preceding a crash event.

Detection Strategies

Inventory Safari, iOS, iPadOS, and macOS versions across managed devices and flag builds prior to 26.5.2.
Correlate endpoint crash telemetry for WebContent processes with proxy or DNS logs to identify potentially malicious URLs.
Monitor MDM compliance dashboards for devices that have not received the 26.5.2 update within the expected patch window.

Monitoring Recommendations

Forward macOS unified logs and iOS crash analytics to a centralized SIEM for correlation with web browsing activity.
Alert on clusters of WebKit crashes across multiple users referencing the same origin or URL pattern.
Track outbound web traffic to newly registered or low-reputation domains from Safari user agents.

How to Mitigate CVE-2026-43717

Immediate Actions Required

Update Safari to version 26.5.2 on macOS systems that have not moved to macOS Tahoe 26.5.2.
Deploy iOS 26.5.2 and iPadOS 26.5.2 to all managed mobile devices through MDM.
Upgrade macOS Tahoe endpoints to 26.5.2 to receive the bundled WebKit fix.
Communicate the risk to users and instruct them to avoid untrusted links until patches are applied.

Patch Information

Apple published fixes in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Refer to Apple Support Article #127594, Apple Support Article #127595, and Apple Support Article #127685 for exact build numbers and installation guidance. Apple describes the remediation as improved memory management addressing the use-after-free condition.

Workarounds

Restrict browsing to trusted sites and enforce web filtering via secure web gateways or DNS reputation services until patches are applied.
Enable Lockdown Mode on high-risk iOS, iPadOS, and macOS accounts to reduce WebKit attack surface.
Where feasible, direct users to an alternate up-to-date browser for untrusted content on unpatched macOS systems.

bash

# Verify Safari and OS versions on macOS
sw_vers
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Trigger the software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart