What is the CVSS score of CVE-2026-43708?

CVE-2026-43708 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-43708?

Yes, a patch is available for CVE-2026-43708. Update the affected software to the latest version immediately.

Apple Safari CVE-2026-43708

EUVD-2026-40201 MEDIUM

Improper Input Validation (CWE-20)

2026-06-29 apple

GHSA-3555-mvv3-v5xj

Information Disclosure Apple Ios And Ipados

4.3

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via malicious site requiring victim to actively visit (UI:R), no privileges needed, limited to partial confidentiality loss with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 22:38 vuln.today

CVSS changed

Jun 29, 2026 - 22:22 NVD

4.3 (MEDIUM)

Patch available

Jun 29, 2026 - 22:02 EUVD

CVE Published

Jun 29, 2026 - 19:42 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 29, 2026 - 19:42 cve.org

MEDIUM 4.3

DescriptionCVE.org

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious website may exfiltrate data cross-origin.

AnalysisAI

Cross-origin data exfiltration in Apple Safari, iOS/iPadOS, and macOS Tahoe (all versions prior to 26.5.2) allows a malicious website to read data belonging to a different origin due to insufficient input validation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered without authentication, requiring only that the victim visits an attacker-controlled page. No public exploit code or CISA KEV listing has been identified at time of analysis, and vendor-released patches are available for all affected platforms.

Technical ContextAI

The vulnerability is rooted in CWE-20 (Improper Input Validation) within the Safari browser engine - the WebKit-based stack shared across Apple's Safari desktop browser, iOS/iPadOS Safari, and macOS Tahoe. CPE data confirms three distinct product lines are affected: cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*, cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*, and cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*. Cross-origin data exfiltration of this nature typically arises when a browser fails to rigorously validate inputs that govern Same-Origin Policy (SOP) enforcement - for example, malformed URLs, header values, or request parameters that cause the engine to misclassify an origin and permit reads it should block. The vendor's fix description ('improved input validation') corroborates this: the patch tightens how Safari validates origin-related inputs rather than restructuring the SOP enforcement architecture itself.

RemediationAI

The primary fix is to update to Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, or macOS Tahoe 26.5.2, all of which contain vendor-released patches per Apple's advisories at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685. On iOS and iPadOS, users cannot replace the underlying WebKit engine, so applying the OS update is the only effective remediation for those platforms. As a compensating control prior to patching, users can avoid navigating to untrusted or unknown websites, disable JavaScript where operationally feasible (though this breaks most modern web applications), or use a non-WebKit browser on platforms that support alternatives. No vendor-documented workaround specific to this issue has been identified in the referenced advisories.