Apple Safari CVE-2026-43705

Exploitation requires the victim to process attacker-controlled web content - i.e., to open or be served a maliciously crafted page in Safari or any WebKit-rendering surface (WKWebView, in-app browsers, content previews) on an unpatched device running a version before 26.5.2. The CVSS vector confirms PR:N (no authentication) but UI:R (user interaction required), so the principal limiting factor is that the attacker cannot trigger it without the user loading the malicious content; there is no zero-click path indicated. Additional limiting factors: only Apple platforms below 26.5.2 are affected, and on macOS/iOS, Lockdown Mode (which disables JIT) would further constrain exploitation. There are no special server-side configuration prerequisites - any default install of an affected Safari/iOS/iPadOS/macOS version is vulnerable when it renders the malicious content.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated bug whose only gating factor is user interaction - the victim must open attacker-controlled web content. This is a realistic and high-priority profile because drive-by web exploitation against browsers is a common, well-understood attack pattern, and WebKit type-confusion bugs historically have a strong track record of weaponization. However, several escalation signals are absent: this CVE is NOT listed in CISA KEV, no EPSS score is provided in the input, and no POC or exploit code is referenced - so there is no public exploit identified at time of analysis. The bug was reported by Apple itself rather than an external exploitation-tracking party, which is consistent with internal discovery rather than confirmed in-the-wild abuse. Net assessment: treat as a genuine high-priority patch given ubiquity and exploitability class, but exploitation is currently theoretical rather than confirmed - EPSS and KEV data should be re-checked as they mature.

An attacker hosts a malicious web page containing crafted JavaScript or DOM structures that trigger the WebKit type confusion, then lures a victim via phishing, a malvertising frame, or a compromised legitimate site. When the victim opens the page in Safari or any WebKit-backed view on an unpatched device, the type confusion corrupts memory to gain an out-of-bounds read/write primitive, typically the first stage toward code execution within the renderer. No public exploit is identified at time of analysis, but this bug class is historically reliable to weaponize.