Apple Safari
CVE-2025-43535
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious web page
-
ExploitLure victim to open in Safari/WebKit
-
ExecutionContent triggers memory-handling flaw
-
ImpactWebKit process crashes (DoS)
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the victim to process attacker-controlled web content in Safari or a WebKit-backed component on an affected Apple OS (iOS/iPadOS before 18.7.3 or 26.2, macOS before Tahoe 26.2, visionOS before 26.2, or Safari before 26.2). This is a client-side, user-interaction-gated attack (UI:R): the user must navigate to or open the malicious page. There is no authentication requirement (PR:N), but the sole outcome is an unexpected WebKit process crash (denial of service) - no confidentiality or integrity impact and no code execution. The limiting factors are the need for user interaction and that impact is confined to a recoverable process crash on unpatched versions. |
| Impact | This is a genuinely low-priority issue despite the network attack vector. The vendor CVSS of 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) is consistent with the description: the only impact is 'an unexpected process crash' (A:L, with C:N/I:N), i.e. a denial-of-service against the WebKit content/rendering process - not memory corruption leading to code execution. Attack vector is network but requires user interaction (UI:R), since the victim must load maliciously crafted web content. EPSS is 0.85% (56th percentile), which is unremarkable and does not indicate imminent mass exploitation. There is no public exploit identified at time of analysis and this is not on CISA KEV, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Signals are internally consistent (moderate EPSS, low CVSS, DoS-only impact, no KEV/POC), so there is no conflict to flag - this reads as a routine WebKit stability/DoS fix bundled into a coordinated Apple update, not a security emergency. Note CWE is 'N/A' in the input and the terse Apple phrasing ('improved memory handling') means the exact bug class is not confirmed beyond a memory-handling defect resulting in a crash. |
| Exploit ScenarioDerived | An attacker hosts a web page containing maliciously crafted content and lures a victim into visiting it in Safari or any WebKit-based view on an affected Apple device. When the content is processed, the WebKit process mishandles memory and crashes, terminating the browsing session or tab. No public exploit code is identified, and the flaw yields only a process crash (no code execution or data disclosure). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Processing maliciously crafted web content in WebKit-based Apple products can crash the browser or the underlying rendering process, producing a denial-of-service condition with no confidentiality or integrity impact. Affected are Safari before 26.2, iOS/iPadOS before 18.7.3 and before 26.2, macOS Tahoe before 26.2, and visionOS before 26.2; the attack is unauthenticated (CVSS PR:N) but gated on user interaction (UI:R), since the victim must navigate to or open the attacker's page. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is only 0.85% (56th percentile), which together with the crash-only outcome make this a genuinely low-priority issue despite the network attack vector. Apple addressed it through improved memory handling in its December 2025 platform updates.
RemediationAI
Apply the vendor-released updates, which are the only complete fix: Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3 (for devices on the 18.x line), iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, and visionOS 26.2, as documented in Apple advisories https://support.apple.com/en-us/125884, https://support.apple.com/en-us/125885, https://support.apple.com/en-us/125886, https://support.apple.com/en-us/125891, and https://support.apple.com/en-us/125892. Because the defect is only reachable through WebKit rendering, the practical workaround until patching is to restrict navigation to trusted sites and avoid opening untrusted links or unsolicited web content, which reduces exposure but is not a guaranteed mitigation and imposes obvious usability costs; note that third-party browsers and in-app web views on iOS/iPadOS/visionOS cannot be fixed independently of the OS update, so device-level patching is mandatory. Given the crash-only outcome, the low EPSS score (0.85%), the absence of KEV or public exploit code, and the UI:R precondition, this does not warrant emergency change control - fold it into the next scheduled Apple platform update cycle rather than initiating an out-of-band response.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in WebKit, the browser engine shared by Safari on macOS and by the WebContent rendering process that backs every third-party browser and in-app web view on iOS, iPadOS, and visionOS. Apple's advisory language - 'the issue was addressed with improved memory handling' - is its standard formulation for a memory-safety defect (typically a use-after-free, out-of-bounds access, or improper lifetime management) whose practical effect here is bounded to memory corruption that terminates the process rather than yielding a controlled primitive. Apple did not assign a CWE for this record, but the crash-only impact, the CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, and the absence of any reported code-execution or data-disclosure consequence indicate the corruption is not exploitable for control-flow hijack in the affected builds. The CPE data maps the weakness across the full Apple web stack - apple:safari, apple:iphone_os, apple:ipados, apple:macos, and apple:visionos - confirming a single shared WebKit root cause with per-platform patches rather than five separate defects. The attack surface is the normal content-parsing path (HTML, JavaScript, or media handling) reached simply by loading a page, which is why the vector is network-reachable while still requiring a user action.
Know when Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Remote malicious web content (AV:N) needs no privileges but requires the victim to load the page (UI:R); impact is a single process crash, so A:L only with C:N/I:N.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
DescriptionCVE.org
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
GitHub PoC
Exploit-DB