CVE-2025-43529
📋 TL;DR
A use-after-free vulnerability in Apple's WebKit browser engine allows processing malicious web content to execute arbitrary code. This affects multiple Apple operating systems and Safari browser versions. Apple reports this may have been exploited in sophisticated targeted attacks against iOS versions before iOS 26.
💻 Affected Systems
- watchOS
- Safari
- iOS
- iPadOS
- macOS Tahoe
- visionOS
- tvOS
📦 What is this software?
Ipados by Apple
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Safari by Apple
Tvos by Apple
Watchos by Apple
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the device, data theft, and persistent access.
Likely Case
Targeted attacks against high-value individuals leading to data exfiltration, surveillance, or credential theft.
If Mitigated
Limited impact with proper network segmentation, web filtering, and updated systems preventing exploitation.
🎯 Exploit Status
Apple confirms exploitation in targeted attacks against specific individuals. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: watchOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, tvOS 26.2
Vendor Advisory: https://support.apple.com/en-us/125884
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Go to General > Software Update. 3. Download and install the latest available update. 4. Restart device when prompted.
🔧 Temporary Workarounds
Disable JavaScript in Safari
allPrevents execution of malicious JavaScript that could trigger the vulnerability.
Use alternative browser
allSwitch to browsers not based on WebKit engine until patched.
🧯 If You Can't Patch
- Implement strict web content filtering to block malicious sites
- Segment vulnerable devices from critical network resources
🔍 How to Verify
Check if Vulnerable:
Check device version in Settings > General > About > Software VersionCheck Version:
sw_vers (macOS) or Settings > General > About > Software Version (iOS/iPadOS)Verify Fix Applied:
Verify installed version matches or exceeds patched versions listed in fix_official.patch_version📡 Detection & Monitoring
Log Indicators:
- Unusual Safari/WebKit process crashes
- Suspicious web content processing
Network Indicators:
- Connections to known malicious domains serving web content
SIEM Query:
source="*safari*" OR process="WebKit" AND (event="crash" OR event="memory_violation")🔗 References
- https://support.apple.com/en-us/125884
- https://support.apple.com/en-us/125885
- https://support.apple.com/en-us/125886
- https://support.apple.com/en-us/125889
- https://support.apple.com/en-us/125890
- https://support.apple.com/en-us/125891
- https://support.apple.com/en-us/125892
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43529
