CVE-2026-43735 Overview
CVE-2026-43735 is a cross-origin data exfiltration vulnerability affecting Apple Safari, iOS, iPadOS, and macOS. A malicious website can bypass same-origin protections and read data belonging to other origins when a user visits attacker-controlled content. Apple addressed the issue through improved checks in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. The flaw is categorized under [CWE-352] (Cross-Site Request Forgery) and requires user interaction to trigger, such as visiting a crafted web page. Successful exploitation exposes confidential information from authenticated sessions on unrelated web applications.
Critical Impact
A malicious website can read data cross-origin, allowing theft of authenticated session content from unrelated web applications visited by the victim.
Affected Products
- Apple Safari (versions prior to 26.5.2)
- Apple iOS and iPadOS (versions prior to 26.5.2)
- Apple macOS Tahoe (versions prior to 26.5.2)
Discovery Timeline
- 2026-06-29 - CVE-2026-43735 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-43735
Vulnerability Analysis
The vulnerability breaks the same-origin policy enforced by WebKit, the browser engine underlying Safari and web views on iOS, iPadOS, and macOS. The same-origin policy prevents documents loaded from one origin from reading responses returned by another origin. When the check fails, an attacker-controlled page can issue requests to third-party sites and retrieve response data that should be restricted.
Apple's advisory attributes the fix to improved checks, indicating the root defect resides in origin validation logic rather than a memory safety error. The classification under [CWE-352] reflects the cross-origin request semantics, though the impact extends beyond state-changing actions to data disclosure. Requests carry the victim's ambient authentication such as cookies and session tokens, allowing the malicious origin to read authenticated content.
Root Cause
The root cause is insufficient enforcement of cross-origin access controls in WebKit-based components shipped with Safari and Apple operating systems. Missing or incomplete boundary checks allow a script running on a malicious origin to observe responses from other origins that should be opaque.
Attack Vector
Exploitation is network-based and requires user interaction. A victim must load a malicious page in Safari or any WebKit-backed component such as an in-app browser view. Once the page executes, embedded scripts issue requests to sensitive targets and read the responses, bypassing origin isolation. No credential prompt or elevated privilege is required, since the browser transparently attaches session cookies to the outbound requests.
No verified proof-of-concept exploit code is publicly available. See the Apple Support Article #127594, Apple Support Article #127595, and Apple Support Article #127685 for vendor technical details.
Detection Methods for CVE-2026-43735
Indicators of Compromise
- Outbound HTTP requests from Safari or WebKit processes to unfamiliar domains followed by inbound flows carrying session tokens or authenticated response bodies.
- Browser telemetry showing execution of vulnerable Safari, iOS, iPadOS, or macOS versions prior to 26.5.2 on managed devices.
- Web server logs on internal applications recording cross-origin requests originating from unexpected Referer or Origin headers.
Detection Strategies
- Inventory managed Apple endpoints and mobile devices to identify unpatched Safari, iOS, iPadOS, and macOS builds.
- Correlate DNS and proxy logs to flag user visits to newly registered or low-reputation domains that subsequently generate requests to internal SaaS applications.
- Alert on anomalous cross-origin request patterns in web application firewall logs, particularly those bearing valid session cookies from unusual referrers.
Monitoring Recommendations
- Monitor mobile device management (MDM) reports for OS version compliance and force updates on non-compliant devices.
- Enable extended browser and web proxy logging to retain full URL and referrer data for post-incident analysis.
- Track authentication anomalies on internal web applications, including session use from geolocations or user agents that diverge from established baselines.
How to Mitigate CVE-2026-43735
Immediate Actions Required
- Update Safari, iOS, and iPadOS devices to version 26.5.2 and macOS systems to Tahoe 26.5.2 without delay.
- Enforce update compliance through MDM policies and block non-compliant devices from accessing sensitive internal applications.
- Communicate the risk to end users and instruct them to avoid unknown links until patching completes.
Patch Information
Apple has released fixes in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. Details are documented in Apple Support Article #127594, Apple Support Article #127595, and Apple Support Article #127685.
Workarounds
- Use an alternative non-WebKit browser on macOS for high-sensitivity browsing until the patch is applied.
- Configure enterprise web applications to require SameSite=Strict cookies and short session lifetimes, reducing exposure of session tokens to cross-origin requests.
- Deploy content security policies and origin isolation headers such as Cross-Origin-Resource-Policy and Cross-Origin-Opener-Policy on internal applications to limit the data an attacker can read.
# Verify Safari and macOS versions on managed endpoints
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString
# Trigger managed software update on macOS
sudo softwareupdate --install --all --restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
