Apple Safari CVE-2026-43704

Exploitation requires that the victim has installed a malicious Safari web extension on their device - this is a hard prerequisite and the primary limiting factor. User interaction is required (UI:R per CVSS vector), meaning passive browsing alone is insufficient; the attacker must engineer a specific interaction or trigger via the extension. Attack complexity is rated High (AC:H), indicating that beyond the extension installation requirement, specific memory conditions or race states must be met. The vulnerability is scoped to the Safari process (S:U, unchanged scope), so exploitation does not inherently escape the browser sandbox. Platforms limited to those running Safari, iOS/iPadOS prior to 26.5.2, or macOS Tahoe prior to 26.5.2 are in scope. Users who do not install third-party web extensions are not realistically exposed.

The CVSS 3.1 base score of 5.3 (Medium) is supported by a vector of AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H. Attack complexity is rated High (AC:H), reflecting the need for specific preconditions - namely, a malicious web extension must already be installed and user interaction must occur. The impact is strictly availability (A:H: process crash); there is no confidentiality or integrity exposure in the reported impact, limiting real-world consequence to a denial-of-service. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified, further reducing urgency. The combination of AC:H, UI:R, and the web-extension delivery requirement makes mass or automated exploitation implausible; this is most plausible as a targeted or socially-engineered attack. The overall risk profile is moderate for users who install third-party Safari extensions, and low for those who do not.

An attacker publishes or distributes a malicious Safari web extension - potentially via a third-party site or social engineering - and convinces a user to install it. Once installed, when the user interacts with the browser in a way that triggers the extension's use-after-free code path, the Safari process crashes unexpectedly, resulting in loss of the browsing session and a denial-of-service condition. No public proof-of-concept code has been identified, and the high attack complexity (AC:H per CVSS) indicates reliable exploitation requires careful engineering of the memory state.