Skip to main content

Apple Safari CVE-2026-43721

| EUVDEUVD-2026-40215 MEDIUM
Incorrect Permission Assignment for Critical Resource (CWE-732)
2026-06-29 apple GHSA-w4j5-xp5j-wg64
Information Disclosure Apple Ios And Ipados
6.5
CVSS 3.1 · Vendor: apple
Share

Severity by source

Vendor (apple) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today AI
7.5 HIGH

Remote malicious page needs no auth or user interaction (AV:N/AC:L/PR:N/UI:N); silent clipboard read discloses sensitive data (C:H) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

7
Severity Changed
Jun 30, 2026 - 20:22 NVD
HIGH MEDIUM
CVSS changed
Jun 30, 2026 - 20:22 NVD
7.5 (HIGH) 6.5 (MEDIUM)
Analysis Generated
Jun 30, 2026 - 13:23 vuln.today
CVSS changed
Jun 30, 2026 - 13:22 NVD
7.5 (HIGH)
Patch available
Jun 29, 2026 - 22:02 EUVD
CVE Published
Jun 29, 2026 - 19:43 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 29, 2026 - 19:43 cve.org
HIGH 7.5

DescriptionCVE.org

This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious website may be able to silently hijack clipboard data.

AnalysisAI

Clipboard data disclosure in Apple Safari (and the shared WebKit engine on iOS, iPadOS, and macOS) before version 26.5.2 lets a malicious website silently read or hijack clipboard contents without user interaction or permission, rated CVSS 7.5 (confidentiality-only). Apple has shipped fixes in Safari 26.5.2, iOS/iPadOS 26.5.2, and macOS Tahoe 26.5.2, and the issue was reported internally by Apple. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in WebKit's clipboard access handling, the engine shared across Safari, iOS/iPadOS, and macOS (per CPE strings cpe:2.3:a:apple:safari, cpe:2.3:a:apple:ios_and_ipados, and cpe:2.3:a:apple:macos). The root cause is classed as CWE-732 (Incorrect Permission Assignment for a Critical Resource): browser clipboard read APIs are normally gated behind user gesture or permission checks, but a state-management defect allowed a web page to bypass those checks and access clipboard data programmatically. Apple's advisory states the fix was 'addressed through improved state management,' indicating the permission/authorization state for clipboard reads was not reliably enforced across page interactions.

RemediationAI

Vendor-released patch: update to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, or macOS Tahoe 26.5.2 as applicable to the device, per Apple's advisories at https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685. Because all three OS/browser updates share the fix, ensure every Apple endpoint in the fleet is brought current. No vendor workaround is published; as interim compensating controls before patching, avoid copying sensitive secrets (passwords, 2FA codes, recovery phrases) to the clipboard while browsing untrusted sites, and clear the clipboard after pasting sensitive values - these reduce the value of any silent read but do not close the flaw and degrade usability for password-manager copy/paste workflows. Where managed, deploy the updates via MDM to enforce timely remediation.

More in Ios And Ipados

View all
CVE-2026-43723 HIGH POC
7.8 Jul 27

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
CVE-2026-65414 CRITICAL
9.8 Sep 14

We need answer JSON only. Need carefully construct fields. Need follow instructions. Must use all data. Need risk_assess
CVE-2026-64771 CRITICAL
9.8 Jul 27

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
CVE-2026-43803 CRITICAL
9.8 Jul 27

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
CVE-2026-43810 CRITICAL
9.8 Jul 27

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
CVE-2026-64770 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
CVE-2026-64769 CRITICAL
9.8 Jul 27

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
CVE-2026-64774 CRITICAL
9.8 Jul 27

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
CVE-2026-64772 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
CVE-2026-43807 CRITICAL
9.8 Jul 27

Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,
CVE-2026-64733 CRITICAL
9.8 Jul 27

A data protection flaw in multiple Apple operating systems allows a locally-installed app to fingerprint the user. An at
CVE-2026-43799 CRITICAL
9.8 Jul 27

Denial-of-service (unexpected system termination) affects Apple's shared OS platforms - iOS/iPadOS before 26.6, macOS Se

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all
CVE-2017-9462 HIGH POC
8.8
CVE-2017-3006 HIGH POC
8.8
CVE-2017-9602 CRITICAL POC
9.8
CVE-2022-22960 HIGH POC
7.8
CVE-2021-38085 HIGH POC
7.8
CVE-2021-35449 HIGH POC
7.8
CVE-2020-11855 HIGH POC
7.8
CVE-2020-10883 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

Share

CVE-2026-43721 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy