WebKit CVE-2026-43660

Apply vendor-released patches immediately: upgrade iOS and iPadOS devices to version 18.7.9 or 26.5 (depending on device compatibility), macOS systems to Tahoe 26.5, Apple TV devices to tvOS 26.5, Vision Pro headsets to visionOS 26.5, and Apple Watch devices to watchOS 26.5. Updates available through standard Apple software update mechanisms (Settings > General > Software Update on iOS/iPadOS, System Settings > General > Software Update on macOS). Organizations managing Apple devices via MDM should deploy these updates through established patch management workflows. No workaround mitigates the CSP bypass without patching; however, defense-in-depth strategies reduce risk: implement server-side input validation and output encoding independent of CSP, deploy Web Application Firewalls to detect and block malicious payloads, restrict user access to untrusted websites via DNS filtering or proxy controls, and monitor web traffic for anomalous data exfiltration patterns. These compensating controls add detection/prevention layers but do not eliminate the vulnerability. Detailed security content descriptions available in Apple security advisories HT127110-HT127120.