Apple iOS/macOS CVE-2026-43703

The victim must actively process malicious web content - by opening a crafted URL in Safari or any WebKit-based browser, loading a web view within an application, or rendering remote HTML content. User interaction is a hard requirement (CVSS UI:R): the attacker cannot trigger the crash without the victim taking an action to open or navigate to the malicious content. No authentication, elevated device privileges, non-default system configuration, or special Apple feature must be enabled for exploitation to succeed. Exploitation is bounded by: (1) the mandatory user-interaction step, preventing fully automated or silent delivery, (2) the impact ceiling being limited to a process crash rather than persistent code execution or data exfiltration per the CVSS C:N/I:N ratings, and (3) the vulnerability being present only on Apple iOS/iPadOS and macOS Tahoe releases prior to 26.5.2.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-reachable, low-complexity attack (AV:N/AC:L) requiring no attacker privileges (PR:N) but requiring user interaction (UI:R), with unchanged scope (S:U) and impact confined entirely to availability (A:H, C:N, I:N). The unchanged scope confirms the crash does not escape the web process boundary. No EPSS data was provided in the source intelligence; absence of a KEV listing means active exploitation is not confirmed at time of analysis. A notable discrepancy exists in the metadata: the 'Information Disclosure' tag conflicts with the CVSS C:N rating and the crash-only description - CWE-125 can theoretically expose adjacent memory contents, but neither Apple's advisory nor the CVSS vector corroborates a confidentiality impact here. That tag should be treated as unconfirmed. Overall, this is a moderate-priority patch for consumer Apple device fleets and a lower priority for enterprise environments where web browsing on managed devices is restricted, given the crash-only impact and the user-interaction prerequisite.

An attacker crafts a webpage containing malicious HTML, JavaScript, or media content that triggers the out-of-bounds read in Apple's web processing engine, then delivers a link to the page via phishing email, malicious advertisement, or redirect chain. A victim on an unpatched iOS, iPadOS, or macOS device who opens the link causes the browser or in-app web view to crash, resulting in a denial-of-service condition. No public exploit code is known at time of analysis, but the low attack complexity suggests a reliable crash primitive is achievable by a moderately skilled attacker once the specific memory boundary condition is identified.