Apple Safari
CVE-2025-43541
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious web page
-
DeliveryLure victim to load in Safari
-
ExploitTrigger type confusion in WebKit rendering
-
ExecutionCorrupt process memory
-
ImpactCrash Safari (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open or render attacker-controlled web content in Safari or a WebKit-based view (UI:R) on an unpatched Apple device (Safari before 26.2; iOS/iPadOS before 18.7.3 or 26.2; macOS before Tahoe 26.2; visionOS before 26.2). No authentication and no special server-side configuration are needed, but exploitation is gated on user interaction (visiting/loading the malicious page). The realistic ceiling of impact is a content-process crash - there is no confirmed path to code execution, data theft, or integrity impact from this issue alone. |
| Impact | This is a WebKit/Safari type confusion (CWE-843) whose vendor-confirmed impact is limited to an unexpected Safari crash - availability-only, with no code execution, data disclosure, or integrity loss (CVSS:3.1 vector C:N/I:N/A:L, base 4.3). The CVSS signals are internally consistent: network-reachable via malicious web content (AV:N), low complexity (AC:L), no privileges (PR:N), but requiring the victim to load attacker content (UI:R), no scope change (S:U). The standout conflicting signal is EPSS at 34.14% (98th percentile) - unusually high for a DoS-only browser bug and far above the norm for a same-day patch with no KEV listing and no identified public exploit; this most likely reflects EPSS model weighting of Apple WebKit CVEs (a historically heavily-targeted attack surface) and the memory-corruption class rather than confirmed weaponization of THIS crash. There is no CISA KEV entry and no public exploit identified at time of analysis, so treat the high EPSS as a probabilistic prior, not evidence of active exploitation. Net: for most environments this is a LOW real-world priority (a crash, self-recoverable), but the type-confusion primitive underlying the crash is the kind of bug that can be developed into memory-corruption RCE, so patch on the normal cadence and do not dismiss it purely on the low CVSS. |
| Exploit ScenarioDerived | An attacker hosts a web page with maliciously crafted content and lures a victim into visiting it in Safari (or an embedded WebKit view) on iOS, iPadOS, macOS, or visionOS. Rendering the content triggers a type confusion in WebKit that corrupts memory and crashes the Safari/content process. No public exploit code has been identified; per the vendor the observed impact is a crash rather than code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Type confusion in Apple's WebKit engine, used by Safari and other WebKit-based applications, can be triggered by processing maliciously crafted web content, leading to an unexpected Safari crash on unpatched devices. Affected versions include Safari before 26.2, iOS/iPadOS before 18.7.3 and 26.2, macOS before Tahoe 26.2, and visionOS before 26.2. No public exploit code has been identified at time of analysis, though the EPSS score is elevated at 34.14% (98th percentile). The vulnerability requires user interaction and is unauthenticated (PR:N), but impact is limited to denial of service (availability only) with no confidentiality or integrity impact.
RemediationAI
Apply the vendor patches: update to Safari 26.2, iOS 18.7.3 or 26.2, iPadOS 18.7.3 or 26.2, macOS Tahoe 26.2, and visionOS 26.2. These updates resolve the type confusion issue. For devices that cannot be immediately updated, consider restricting the rendering of untrusted web content in Safari or WebKit-based views, though this may impact user experience. There are no specific workarounds beyond applying the updates, as the vulnerability requires user interaction and impacts only availability (crash). Monitor Apple's advisories for further information.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a type confusion (CWE-843) in WebKit, the browser engine used by Safari and other applications that render web content. Type confusion occurs when a program interprets an object as a different type than intended, often leading to memory corruption. In this instance, Apple addressed the issue with improved state handling. The affected CPEs include apple:safari, apple:ipados, apple:iphone_os, apple:macos, and apple:visionos. The attack vector is network-based (AV:N) with low complexity (AC:L) and requires user interaction (UI:R) because the victim must load or view the malicious content. The vulnerability is unauthenticated (PR:N). The resulting impact is solely to availability (A:L), causing a crash of the Safari process, with no impact to confidentiality or integrity. No code execution or data disclosure has been confirmed.
Know when Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Network-delivered web content (AV:N/AC:L/PR:N) requires the victim to load the page (UI:R); vendor confirms crash-only, so C:N/I:N and A:L with no scope change.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
DescriptionCVE.org
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
GitHub PoC
Exploit-DB