CVE-2026-43792: Apple Safari Auth Bypass Vulnerability

CVE-2026-43792 Overview

CVE-2026-43792 is an authorization vulnerability affecting Apple Safari and macOS Tahoe. The flaw stems from improper state management in the authorization logic, allowing a malicious app to access sensitive user data. Apple addressed the issue in Safari 26.6 and macOS Tahoe 26.6 through improved state management. The vulnerability is classified under [CWE-285: Improper Authorization]. Exploitation requires user interaction, and the attack vector is network-based. While no public exploit is available and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, the confidentiality impact is high.

Critical Impact
An app may be able to access sensitive user data on affected Safari and macOS Tahoe installations by leveraging improper authorization state handling.

Affected Products

Apple Safari (versions prior to 26.6)
Apple macOS Tahoe (versions prior to 26.6)
Applications and web content processed by affected Safari/WebKit components

Discovery Timeline

2026-07-27 - CVE-2026-43792 published to the National Vulnerability Database
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-43792

Vulnerability Analysis

The vulnerability is an authorization flaw rooted in improper state management within Apple Safari and macOS Tahoe. Authorization state that governs access to sensitive user data is not consistently maintained across relevant code paths. As a result, an application can reach data that would otherwise require additional authorization checks. Apple's advisory describes the outcome plainly: an app may be able to access sensitive user data. The issue maps to [CWE-285: Improper Authorization], a class of defects where enforcement decisions do not match the intended access policy. Exploitation requires user interaction, such as visiting attacker-controlled web content or launching a crafted application, which aligns with the network attack vector reported for the CVE.

Root Cause

The root cause is inconsistent tracking of authorization state during operations that touch sensitive resources. When the authorization state is not correctly propagated or invalidated, subsequent operations proceed without the checks the design intended. Apple's fix hardens state management so that authorization decisions remain accurate across relevant transitions.

Attack Vector

An attacker delivers a malicious application or crafted web content to a target running a vulnerable version of Safari or macOS Tahoe. After user interaction, the app or content triggers the code path where authorization state is mishandled. The flaw then permits access to user data that should have remained protected. No verified public proof-of-concept code is available for this issue. Consult the Apple Security Advisory #128067 and Apple Security Advisory #128073 for vendor guidance.

Detection Methods for CVE-2026-43792

Indicators of Compromise

Safari or macOS Tahoe installations reporting versions earlier than 26.6 in inventory data
Unexpected reads of protected user data (Keychain items, browser storage, Files, Photos) by non-standard applications
Newly installed or unsigned applications making requests to Safari or WebKit interfaces shortly after user browsing activity

Detection Strategies

Query endpoint inventory for Safari and macOS Tahoe build versions and flag hosts below 26.6
Correlate process telemetry of untrusted applications with access attempts to sensitive user data stores
Monitor macOS unified logs for anomalous authorization decisions tied to Safari and WebKit components

Monitoring Recommendations

Alert on execution of unsigned or newly installed applications immediately following user web browsing sessions
Track network connections from user-mode applications to domains associated with recent phishing or drive-by campaigns
Baseline normal application access patterns to user data directories and alert on deviations

How to Mitigate CVE-2026-43792

Immediate Actions Required

Update Safari to version 26.6 on all supported platforms
Update macOS Tahoe systems to version 26.6
Restrict installation of untrusted applications through Gatekeeper and MDM policies
Educate users to avoid opening untrusted links and applications delivered via email or messaging

Patch Information

Apple has released fixes in Safari 26.6 and macOS Tahoe 26.6. The vendor states the issue was addressed with improved state management. Refer to Apple Security Advisory #128067 and Apple Security Advisory #128073 for the complete list of addressed issues and installation instructions.

Workarounds

Apply the vendor patches; Apple has not documented a supported workaround for this issue
Limit use of Safari on unpatched hosts and prefer alternative browsers until updates are installed
Enforce least privilege for applications that request access to sensitive user data via macOS TCC prompts

bash

# Verify installed Safari version on macOS
defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString

# Verify macOS build
sw_vers

# Trigger the Software Update pane to apply pending Apple updates
softwareupdate --list
sudo softwareupdate --install --all --restart