WebKit CVE-2026-43660

Exploitation requires the victim to process web content using the vulnerable WebKit engine, which occurs when browsing websites in Safari, viewing web content in third-party iOS apps using WebView/WKWebView, or interacting with any web-rendered content on affected Apple platforms. The target website must implement Content Security Policy headers-sites without CSP are unaffected since there is no security policy to bypass. No special WebKit features, non-default browser configurations, or specific user interactions (beyond page load) are required. The attack works against default Apple device configurations running vulnerable OS versions. Network connectivity is required (AV:N) but no VPN, proxy, or specific network topology. Exploitation is NOT limited by: authentication requirements (PR:N means unauthenticated), attack complexity barriers (AC:L means straightforward exploitation), or mandatory user interaction (UI:N means automatic upon content processing).

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote exploitation requiring no authentication or user interaction, suggesting broad attack surface. However, the CVSS score of 7.5 reflects only confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N), meaning attackers can read data but not modify systems or cause denial of service. The EPSS score of 0.03% (10th percentile) suggests security researchers have not observed widespread exploitation attempts despite the accessible attack surface. Absence from CISA KEV confirms no known active exploitation in federal enterprise environments. The real-world risk centers on specific deployment scenarios where CSP is the primary defense against data exfiltration from web applications. Organizations relying on CSP to protect sensitive web applications should prioritize patching. General users face lower immediate risk since exploitation requires visiting malicious websites and only bypasses one security layer (CSP), not broader platform protections. The scope metric (S:U) confirms no privilege escalation beyond the WebKit sandbox.

An attacker hosts a malicious website or compromises a legitimate site to serve crafted HTML/JavaScript content. When a victim using an unpatched Apple device visits the page via Safari or an in-app WebView, the malicious content exploits the validation flaw to bypass the site's Content Security Policy. With CSP protections circumvented, the attacker's code exfiltrates sensitive data normally protected by CSP restrictions-such as authentication tokens, form data, or cross-origin information-to attacker-controlled servers. The attack requires no user interaction beyond visiting the malicious page. No publicly available proof-of-concept code identified at time of analysis.