CVE-2026-43804: Apple Safari DoS Vulnerability

CVE-2026-43804 Overview

CVE-2026-43804 is a denial-of-service vulnerability affecting Apple Safari and multiple Apple operating systems. The issue stems from improper state management in Safari's web content handling. Visiting a maliciously crafted website can trigger an application denial-of-service condition on the target device. Apple addressed the flaw through improved state management logic. The vulnerability is categorized under [CWE-400] Uncontrolled Resource Consumption. It requires user interaction, specifically navigation to an attacker-controlled webpage, but no privileges or authentication.

Critical Impact
Remote attackers can cause application-level denial-of-service on Safari and Apple platforms by luring users to a crafted website, disrupting browsing sessions and dependent workflows.

Affected Products

Apple Safari (versions prior to 26.6)
Apple iOS and iPadOS (versions prior to 26.6)
Apple macOS Tahoe (versions prior to 26.6)
Apple visionOS (versions prior to 26.6)

Discovery Timeline

2026-07-27 - CVE-2026-43804 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-43804

Vulnerability Analysis

The vulnerability resides in Safari's web content handling logic, where improper state management allows a specifically constructed webpage to place the application into an invalid or unrecoverable state. When Safari or a WebKit-based component processes the malicious content, resource consumption or state corruption forces the application to terminate or become unresponsive. Apple's advisories describe the fix as improved state management, indicating the underlying condition involves inconsistent tracking of internal object or session state during page load or rendering. The flaw impacts availability only. Confidentiality and integrity remain unaffected based on the vendor's characterization.

Root Cause

The root cause is a state management defect classified as [CWE-400] Uncontrolled Resource Consumption. Safari fails to correctly validate or reset internal state under specific content-driven conditions, allowing an attacker to force the browser or embedded WebKit process into a degraded or crashed state. Apple's security notes do not disclose the specific object or handler at fault.

Attack Vector

Exploitation requires the victim to visit a malicious website using a vulnerable Safari version or WebKit-based component on an unpatched Apple platform. No authentication is required. The attack is fully remote over the network, and delivery can occur through phishing links, malvertising, compromised sites, or embedded iframes. Because WebKit underlies Safari across iOS, iPadOS, macOS, and visionOS, the same content can affect multiple device classes.

No public proof-of-concept code has been released for CVE-2026-43804. See the Apple Security Update Advisory for vendor technical details.

Detection Methods for CVE-2026-43804

Indicators of Compromise

Repeated Safari or WebKit process crashes (com.apple.WebKit.WebContent) shortly after visiting a specific URL.
Unexpected termination logs in macOS Unified Logging or iOS crash reports referencing WebKit rendering components.
Users reporting Safari becoming unresponsive or quitting when navigating to the same external site.

Detection Strategies

Monitor endpoint telemetry for elevated crash rates in Safari and WebKit-hosted processes across managed Apple fleets.
Correlate web proxy or DNS logs with reported crash events to identify URLs that consistently trigger application termination.
Track Safari and OS build versions across the estate to flag devices running versions earlier than 26.6.

Monitoring Recommendations

Ingest macOS and iOS crash telemetry into the SIEM and alert on anomalous WebKit process termination clusters.
Enrich outbound web traffic logs with threat intelligence to flag known malicious or newly registered domains.
Track patch compliance for Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, and visionOS 26.6.

How to Mitigate CVE-2026-43804

Immediate Actions Required

Update all Apple endpoints to Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, or visionOS 26.6 as applicable.
Push the update through MDM to ensure enterprise-wide coverage on managed devices.
Advise users to avoid clicking untrusted links until patches are deployed.

Patch Information

Apple resolved the vulnerability in Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, and visionOS 26.6. Refer to the vendor advisories: Apple advisory 128066, Apple advisory 128067, Apple advisory 128070, and Apple advisory 128073.

Workarounds

Restrict browsing to trusted sites using enterprise web filtering or Safari content blockers until patches are applied.
Use MDM configuration profiles to enforce Safari update policies and defer risky extensions.
Educate users about phishing lures that could deliver the malicious URL required for exploitation.

bash

# Configuration example: verify Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Trigger managed software update via MDM (example using softwareupdate)
sudo softwareupdate --install --all --restart