Apple iOS/iPadOS CVE-2026-43794

Exploitation requires the target user to actively process maliciously crafted web content - navigating to an attacker-controlled URL, opening a crafted file that invokes WebKit, or interacting with embedded web content within an application. This user interaction (UI:R in the CVSS vector) is the sole prerequisite and the primary limiting factor: the attack cannot trigger without some form of victim engagement with the malicious content. No authentication to the device, no elevated application permissions, no developer mode, and no non-default system configuration is required. The vulnerability affects any unpatched Apple device running iOS or iPadOS prior to 18.7.10 / 26.6.1, or macOS Tahoe prior to 26.6.2, regardless of how the device is configured. Exploitation scope is limited to the web renderer process (S:U), though follow-on sandbox escape may extend impact.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-accessible flaw with low attack complexity and no authentication requirement, where the only barrier to exploitation is inducing a user to visit a malicious page. The high C/I/A ratings indicate that successful exploitation can yield full confidentiality, integrity, and availability compromise of the affected process. No EPSS score was provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified; however, Apple WebKit memory corruption vulnerabilities of this class have historically been prime targets for exploit development by both criminal and nation-state actors. No CISA KEV listing and no public proof-of-concept code were identified at time of analysis, which moderates immediate urgency relative to actively exploited flaws - yet even a mid-sized municipal IT team in leszno managing a fleet of iPhones and Macs should treat this as urgent patch deployment, given the ubiquitous deployment footprint and the high C/I/A impact potential. The unchanged scope (S:U) means direct exploitation is contained to the renderer process, but browser sandbox escapes frequently follow as a second stage in sophisticated attack chains.

An attacker hosts or injects a webpage containing specially crafted HTML, JavaScript, or media content engineered to trigger the memory handling flaw in Apple's WebKit rendering engine. When an unpatched iOS, iPadOS, or macOS Tahoe user browses to that page - via Safari, an in-app browser, or any WebKit-based view - the malicious content triggers an out-of-bounds memory operation, yielding arbitrary code execution in the web renderer context. No public proof-of-concept code has been identified at time of analysis, but the low-complexity, network-accessible nature of the attack makes this a realistic target for weaponization.