CVE-2026-43732: Apple Safari Path Traversal Vulnerability

CVE-2026-43732 Overview

CVE-2026-43732 is a path handling vulnerability affecting Apple Safari, iOS, iPadOS, and macOS. The flaw resides in how these products validate paths when processing web content. Attackers who trick a user into loading maliciously crafted web content can disclose sensitive user information. The issue maps to [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). Apple addressed the flaw in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2 through improved validation.

Critical Impact
Processing maliciously crafted web content may disclose sensitive user information to a remote attacker without authentication.

Affected Products

Apple Safari (prior to 26.5.2)
Apple iOS and iPadOS (prior to 26.5.2)
Apple macOS Tahoe (prior to 26.5.2)

Discovery Timeline

2026-06-29 - CVE-2026-43732 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-43732

Vulnerability Analysis

The vulnerability is a path traversal issue [CWE-22] in Apple's WebKit-based browser stack. When Safari and the underlying operating system components process web content, path components can be interpreted in ways that escape the intended restricted directory. This behavior enables an attacker-controlled web page to reference resources outside the boundary the browser expects to enforce. The result is unauthorized disclosure of sensitive user information.

Exploitation requires user interaction. A victim must load or navigate to a page hosting the malicious content. No privileges are required on the target device, and the attack is delivered over the network.

Root Cause

The root cause is insufficient validation of path components during resource resolution within the browser and OS-level components. Apple's advisory states the issue was addressed with improved validation, indicating the original code accepted path sequences that should have been rejected or normalized before use.

Attack Vector

The attack vector is remote and web-based. An attacker hosts crafted content on a controlled site or injects it into a compromised site. When a user with a vulnerable Safari, iOS, iPadOS, or macOS build loads the page, the malicious payload triggers the path handling flaw. Successful exploitation leaks user data readable by the browser process. No verified public proof-of-concept exists at the time of publication.

// No verified proof-of-concept code is available for CVE-2026-43732.
// Refer to Apple's security advisories for authoritative technical detail:
//   https://support.apple.com/en-us/127594
//   https://support.apple.com/en-us/127595
//   https://support.apple.com/en-us/127685

Detection Methods for CVE-2026-43732

Indicators of Compromise

Safari, iOS, iPadOS, or macOS clients running builds earlier than 26.5.2 that visited untrusted or newly registered domains.
Outbound requests from browser processes to URLs containing encoded traversal sequences such as %2e%2e%2f or ..%2f.
Unexpected file read patterns or sandbox violations originating from the WebKit content process.

Detection Strategies

Inventory endpoints and mobile devices to identify Safari and OS versions below 26.5.2 using MDM or endpoint telemetry.
Inspect web proxy and DNS logs for user navigation to domains hosting suspicious HTML or JavaScript payloads referencing local resource paths.
Correlate browser process telemetry with unusual filesystem or IPC activity that could indicate data disclosure.

Monitoring Recommendations

Alert on Safari or WebKit processes accessing user data directories immediately after new-domain navigations.
Track HTTP response bodies containing crafted href, src, or location values with traversal patterns.
Monitor patch compliance dashboards to ensure Apple 26.5.2 updates propagate to all managed devices.

How to Mitigate CVE-2026-43732

Immediate Actions Required

Update Safari, iOS, iPadOS, and macOS to version 26.5.2 or later across all managed and BYOD devices.
Enforce update compliance through MDM policies and block non-compliant devices from accessing sensitive resources.
Warn users against opening untrusted links until patching is confirmed.

Patch Information

Apple released fixes in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Refer to the Apple Support Article 127594, Apple Support Article 127595, and Apple Support Article 127685 for release notes and download instructions.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until updates are deployed.
Disable JavaScript for high-risk user groups where feasible, accepting the usability trade-off.
Use MDM configuration profiles to require the patched OS version before granting access to corporate data.

bash

# Verify Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Verify macOS build
sw_vers

# Trigger Apple software update check
sudo softwareupdate --install --all --restart