CVE-2026-43794: Apple Safari Use-After-Free Vulnerability

CVE-2026-43794 Overview

CVE-2026-43794 is a memory corruption vulnerability affecting Apple Safari, iOS, iPadOS, and macOS. Processing maliciously crafted web content can trigger memory corruption in the WebKit rendering engine. Apple addressed the issue with improved memory handling across Safari 26.6.1, iOS/iPadOS 18.7.10, iOS/iPadOS 26.6.1, and macOS Tahoe 26.6.2. The vulnerability requires user interaction, typically loading an attacker-controlled webpage, and can lead to compromise of confidentiality, integrity, and availability on the affected device.

Critical Impact
A remote attacker who convinces a user to visit a crafted webpage can corrupt process memory in Safari or WebKit-backed applications, enabling potential arbitrary code execution within the browser sandbox.

Affected Products

Apple Safari (prior to 26.6.1)
Apple iOS and iPadOS (prior to 18.7.10 and 26.6.1)
Apple macOS Tahoe (prior to 26.6.2)

Discovery Timeline

2026-08-17 - CVE-2026-43794 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-43794

Vulnerability Analysis

The flaw resides in the WebKit component that parses and renders web content in Safari and other browsers on Apple platforms. Apple describes the root defect as a memory corruption issue mitigated with improved memory handling. The vulnerability falls under [CWE-119], improper restriction of operations within the bounds of a memory buffer.

An attacker crafts HTML, JavaScript, CSS, or other web assets that trigger the flawed code path during rendering. When the target loads the malicious page, the renderer mishandles memory operations, corrupting adjacent heap or stack structures. Successful exploitation can hijack control flow inside the WebKit process, yielding code execution in the browser's renderer sandbox. Chained with a sandbox escape, the primitive can escalate to full device compromise. WebKit is the mandatory browser engine on iOS and iPadOS, so third-party browsers on those platforms are also exposed.

Root Cause

Apple has not published low-level details. The advisory language and CWE-119 classification indicate the renderer performs a buffer operation without adequately validating size or lifetime, resulting in an out-of-bounds access or stale-pointer dereference during web content processing.

Attack Vector

Exploitation occurs over the network and requires user interaction. A victim must visit a malicious site, open an attacker-controlled link, or render hostile content embedded in a webview. No credentials are required. Watering-hole attacks, malvertising, and phishing links are realistic delivery channels. Refer to the Apple Support Document 148281 and related advisories for vendor-provided technical context.

// No verified proof-of-concept code is publicly available.
// The vulnerability is triggered by processing crafted web content
// in the WebKit rendering pipeline.

Detection Methods for CVE-2026-43794

Indicators of Compromise

Unexpected crashes or com.apple.WebKit.WebContent process terminations logged in device crash reports shortly after browsing.
Safari or WebKit-based application spawning unexpected child processes or writing to unusual filesystem locations.
Outbound connections from browser processes to newly registered or low-reputation domains immediately after page load.
Anomalous JavaScript payloads referencing WebKit-specific objects or heap-grooming patterns in captured web traffic.

Detection Strategies

Monitor endpoint telemetry for repeated WebKit renderer crashes correlated with specific URLs or referrers.
Inspect proxy and DNS logs for user navigation to domains flagged by threat intelligence feeds as WebKit exploit delivery infrastructure.
Deploy content inspection at the network edge to identify obfuscated JavaScript patterns consistent with WebKit exploitation.

Monitoring Recommendations

Enforce Safari and OS version inventory checks to identify endpoints running vulnerable builds.
Alert on Mobile Device Management (MDM) compliance drift when devices remain below the patched iOS, iPadOS, or macOS versions.
Retain browser and system crash artifacts for forensic review of suspected exploitation attempts.

How to Mitigate CVE-2026-43794

Immediate Actions Required

Update Safari to 26.6.1, iOS and iPadOS to 18.7.10 or 26.6.1, and macOS to Tahoe 26.6.2 on all managed devices.
Push the update through MDM with enforced installation deadlines for corporate iPhones, iPads, and Macs.
Instruct users to avoid untrusted links until patches are confirmed installed.

Patch Information

Apple released fixes in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, and macOS Tahoe 26.6.2. Details are published in Apple Support Document 148281, Apple Support Document 148282, Apple Support Document 148286, and Apple Support Document 148287.

Workarounds

Restrict browsing to trusted sites and disable JavaScript for high-risk users where feasible using Safari content restrictions.
Enable Lockdown Mode on iOS, iPadOS, and macOS for users at elevated targeting risk until patches are applied.
Route corporate browsing through a filtering proxy that blocks known malicious domains and inspects script payloads.

bash

# Verify installed versions on macOS
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Enforce update via MDM (example: Jamf)
jamf policy -event install-apple-security-update