Apple Safari CVE-2026-43676

The user must actively navigate to or be redirected to a page serving maliciously crafted web content - this is the UI:R (user interaction required) constraint in the CVSS vector. No authentication is required on the attacker's side (PR:N), and no special server-side configuration is needed beyond hosting the crafted content. On iOS and iPadOS, exploitation extends to all browser apps since they are mandated to use the WebKit engine; there is no browser-choice mitigation on that platform. No non-default configuration is required - the vulnerability is exercised through normal web content rendering in default Safari and WebKit deployments. Exploitation is limited to a browser crash (denial of service); the CVSS vector encodes no confidentiality or integrity impact, so data exfiltration or code execution are not confirmed outcomes of this specific CVE.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) accurately captures a network-reachable, low-complexity, unauthenticated denial-of-service triggered by user interaction. The sole confirmed impact is availability - specifically a Safari crash - with no confidentiality or integrity impact encoded in the vector. Notably, the EUVD tags include 'Information Disclosure,' which is inconsistent with both the CVE description (which cites only an 'unexpected crash') and the CVSS vector (C:N); this discrepancy should be treated with caution and verified against Apple's advisories. No EPSS score was provided in the source data. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified. Real-world risk is moderate: the attack surface is broad (Safari is the only permitted browser engine on iOS), but impact is limited to a browser crash - a nuisance-level DoS rather than a system compromise. The UI:R constraint slightly reduces opportunistic exploitation risk compared to a fully passive vector.

An attacker hosts a web page containing maliciously crafted content - such as a specially structured HTML/CSS/JS payload - designed to trigger the out-of-bounds read in Safari's web content parser. When a user navigates to this page, Safari processes the content, the bounds check fails, the OOB read occurs, and Safari crashes. No public proof-of-concept code has been identified at time of analysis, making reliable weaponization harder to reproduce independently.