CVE-2026-43720: Apple Safari Use-After-Free Vulnerability

CVE-2026-43720 Overview

CVE-2026-43720 is a use-after-free vulnerability [CWE-416] affecting Apple Safari and multiple Apple operating systems. Processing maliciously crafted web content can trigger the flaw and cause an unexpected Safari crash. Apple addressed the issue with improved memory management in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.

The vulnerability requires user interaction, typically visiting a malicious web page. Exploitation impacts availability but does not directly compromise confidentiality or integrity according to the published CVSS vector.

Critical Impact
A remote attacker can crash Safari by luring a user to attacker-controlled web content, disrupting browser availability across iPhone, iPad, and Mac endpoints.

Affected Products

Apple Safari (prior to 26.5.2)
Apple iOS and iPadOS (prior to 26.5.2)
Apple macOS Tahoe (prior to 26.5.2)

Discovery Timeline

2026-06-29 - CVE-2026-43720 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-43720

Vulnerability Analysis

CVE-2026-43720 is a use-after-free flaw in Safari's web content processing pipeline. A use-after-free occurs when code continues to reference memory after it has been freed, allowing the freed memory region to be reused for attacker-influenced data. Apple's advisory states the issue was resolved through improved memory management.

The defect is reachable through standard web browsing. When Safari parses or renders specific malicious HTML, JavaScript, or DOM structures, an object is freed while a dangling pointer to that object remains in use. Subsequent dereference of the stale pointer produces memory corruption that terminates the browser process.

Apple describes the observed impact as an unexpected Safari crash, indicating an availability-focused outcome. Use-after-free primitives in browser engines can sometimes be developed into code execution, but no such capability is documented for this CVE and no public proof-of-concept is available.

Root Cause

The root cause is improper object lifetime management within Safari's WebKit-based rendering stack. A referenced object is deallocated while other execution paths retain and later dereference the pointer. This condition is characteristic of [CWE-416] Use After Free.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts crafted web content and induces a target to load the page in a vulnerable Safari version. No authentication or elevated privileges are required. Delivery vectors include phishing links, malvertising, watering hole sites, and embedded iframes on compromised legitimate pages.

No verified exploit code is available for CVE-2026-43720. Refer to the Apple Support Article #127594 for vendor technical guidance.

Detection Methods for CVE-2026-43720

Indicators of Compromise

Repeated unexpected Safari process crashes or com.apple.WebKit.WebContent termination events across managed endpoints.
Crash reports referencing WebKit rendering components immediately after visiting external URLs.
Outbound connections from Safari to newly registered or low-reputation domains preceding browser crash telemetry.

Detection Strategies

Correlate WebKit crash logs with URL browsing history to identify pages that reliably trigger termination.
Monitor MDM inventory for endpoints running Safari, iOS, iPadOS, or macOS Tahoe versions earlier than 26.5.2.
Alert on repeated browser process restarts on the same device within short time windows.

Monitoring Recommendations

Ingest macOS unified logs and iOS crash reports into a centralized logging platform for triage.
Track user-agent and OS version telemetry from web proxies to identify unpatched clients.
Review web filtering logs for known malicious or newly observed domains served immediately before crash events.

How to Mitigate CVE-2026-43720

Immediate Actions Required

Update Safari to version 26.5.2 on all managed macOS systems.
Update iPhone devices to iOS 26.5.2 and iPad devices to iPadOS 26.5.2.
Update macOS Tahoe systems to macOS Tahoe 26.5.2 to receive the bundled Safari fix.
Enforce update compliance through MDM policies and block non-compliant devices from sensitive resources.

Patch Information

Apple released fixes in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. See the Apple Support Article #127594, Apple Support Article #127595, and Apple Support Article #127685 for release details.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patches are deployed.
Use MDM configuration profiles to disable JavaScript in Safari for high-risk user populations as a temporary measure.
Route Safari traffic through a filtering proxy that blocks known malicious domains and inspects web content.

bash

# Verify Safari and macOS versions on managed endpoints
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString

# Trigger MDM-managed software update on macOS
sudo softwareupdate --install --all --restart