CVE-2026-43746: Apple Safari Use-After-Free Vulnerability

CVE-2026-43746 Overview

CVE-2026-43746 is a use-after-free vulnerability [CWE-416] affecting Apple Safari and multiple Apple operating systems. The flaw resides in Safari's web content processing logic. Processing maliciously crafted web content can trigger an unexpected Safari crash, resulting in a denial of service. Apple addressed the issue with improved memory management in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. The vulnerability requires user interaction, such as visiting a malicious webpage, and is exploitable over the network.

Critical Impact
Attackers can crash Safari on unpatched Apple devices by luring users to malicious web content, causing an availability impact on the browser process.

Affected Products

Apple Safari (prior to 26.5.2)
Apple iOS and iPadOS (prior to 26.5.2)
Apple macOS Tahoe (prior to 26.5.2)

Discovery Timeline

2026-06-29 - CVE-2026-43746 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-43746

Vulnerability Analysis

CVE-2026-43746 is a use-after-free condition in Safari's web content handling. Use-after-free vulnerabilities occur when a program continues to reference memory after it has been freed. When Safari processes attacker-controlled web content, the browser dereferences a freed object, leading to undefined behavior and a crash of the Safari process.

Apple's advisory states the issue was addressed with improved memory management. The fix ensures object lifetimes are correctly tracked so that dangling references are not accessed after deallocation. Available exploitation is limited to a denial-of-service outcome according to Apple's advisory, with no reported confidentiality or integrity impact.

Root Cause

The root cause is improper memory management within Safari's rendering or scripting engine. A pointer or reference to a heap object remains in use after the underlying allocation has been released. Subsequent access to that stale reference triggers memory corruption and process termination.

Attack Vector

Exploitation requires a user to load attacker-controlled web content in Safari. An attacker hosts a malicious page or delivers it through advertising, iframe embedding, or phishing links. When the victim visits the page, Safari parses the crafted content and reaches the vulnerable code path, resulting in an unexpected crash.

No authentication is required. The attack is remote and network-based, but the outcome per Apple's advisory is limited to a Safari crash rather than code execution. For technical details, refer to the Apple Support Advisory #127594, Apple Support Advisory #127595, and Apple Support Advisory #127685.

Detection Methods for CVE-2026-43746

Indicators of Compromise

Repeated or unexpected Safari process crashes on iOS, iPadOS, or macOS endpoints
Crash logs referencing WebKit modules with use-after-free signatures such as EXC_BAD_ACCESS or heap corruption stack traces
User reports of Safari tabs closing when visiting specific external URLs

Detection Strategies

Monitor macOS DiagnosticReports and iOS crash logs for recurring Safari or WebKit process terminations
Correlate crash events with recently visited URLs from browser history and MDM telemetry
Track Safari and OS build versions across the fleet to identify devices still running versions prior to 26.5.2

Monitoring Recommendations

Ingest macOS endpoint crash telemetry into a centralized logging platform for anomaly analysis
Alert on outbound connections to newly registered or low-reputation domains from Safari user agents
Review MDM compliance dashboards for devices missing the 26.5.2 update

How to Mitigate CVE-2026-43746

Immediate Actions Required

Update Safari to version 26.5.2 on macOS endpoints without delay
Update iOS and iPadOS devices to version 26.5.2 through MDM or user-driven updates
Update macOS Tahoe systems to build 26.5.2 to receive the WebKit fix
Prioritize patching for users who browse untrusted sites or handle sensitive data

Patch Information

Apple released fixes in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. The patches apply improved memory management to eliminate the use-after-free condition. Refer to Apple Support Advisory #127594, Apple Support Advisory #127595, and Apple Support Advisory #127685 for full patch details.

Workarounds

Use an alternative browser on unpatched systems until the update can be applied
Restrict access to untrusted websites through network filtering or DNS-based blocklists
Enforce MDM policies that require Safari and OS updates within a defined compliance window

bash

# Verify Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Trigger software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart