Skip to main content

Apple Safari CVE-2026-43804

| EUVDEUVD-2026-49434 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-07-27 apple GHSA-mj89-jhh3-3x9r
Denial Of Service Apple Red Hat Visionos Ios And Ipados Suse
6.5
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Host malicious website with crafted content
  2. Delivery
    Social-engineer or redirect user to visit the page
  3. Exploit
    WebKit state management flaw triggered during page load/render
  4. Execution
    Uncontrolled resource consumption exhausts process state
  5. Impact
    Safari or WebKit-based app crashes (denial of service)

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires a user to actively visit a specially crafted malicious website using Safari or a WebKit-based application on an unpatched Apple device. The CVSS vector UI:R confirms this user interaction is mandatory - passive or drive-by exploitation without a user navigating to the site is not possible. PR:N confirms no authentication to the victim device is required. The vulnerability affects default configurations of Safari on all supported Apple platforms (macOS Tahoe, iOS 26, iPadOS 26, visionOS 26) running versions prior to 26.6. Exploitation is limited to an app-level crash (DoS) - attackers cannot gain code execution, exfiltrate data, or persist access. Non-default conditions are not required, but impact is constrained to the Safari/WebKit app process and does not affect OS stability.
Impact

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-delivered, unauthenticated attack requiring user interaction (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). The high availability impact is scoped only to the affected application - not the OS - as S:U. EPSS at 0.16% (6th percentile) is very low, consistent with SSVC's assessment of exploitation status as 'none' and automatable as 'no' (user must actively visit a site). Technical impact is rated 'partial' by SSVC. Taken together, these signals indicate this is a genuine but low-priority vulnerability: real-world risk is constrained by the required user interaction, the DoS-only impact, and the absence of any public exploit or active exploitation. The breadth of affected Apple platforms (iOS, macOS, visionOS, Safari) elevates enterprise and consumer patch urgency slightly, but this is not a critical-priority item absent KEV listing or POC emergence.
Exploit ScenarioDerived

An attacker publishes or compromises a website containing content crafted to trigger the state management flaw in WebKit. When a user on an unpatched Apple device visits the page in Safari or an app using the WebKit engine, the application crashes and becomes unavailable until restarted. No public proof-of-concept code exists at time of analysis, and the attack is not automatable per SSVC assessment.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Safari and WebKit-based apps across Apple platforms crash when a user visits a specially crafted website, due to a state management flaw (CWE-400: Uncontrolled Resource Consumption) in versions prior to 26.6. Affected platforms include Safari on macOS Tahoe, iOS 26, iPadOS 26, and visionOS 26. No confidentiality or integrity impact is present - the consequence is an app-level denial-of-service. No public exploit code exists and CISA SSVC confirms no active exploitation, with EPSS at 0.16% (6th percentile), indicating very low exploitation likelihood at time of analysis.

RemediationAI

The primary fix is to update to the patched versions released by Apple: Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, and visionOS 26.6. These updates are available through standard Apple software update mechanisms and are documented in Apple's security advisories at https://support.apple.com/en-us/128066 (Safari), https://support.apple.com/en-us/128067 (iOS/iPadOS), https://support.apple.com/en-us/128070 (macOS Tahoe), and https://support.apple.com/en-us/128073 (visionOS). As a compensating control where immediate patching is not possible, restricting user access to untrusted or unknown websites via DNS filtering or web proxy content policies can reduce exposure, though this introduces usability trade-offs. There is no known server-side mitigation since the flaw is entirely client-side.

Affected VersionsENISA

iOS and iPadOS 0 <26.6
visionOS 0 <26.6
macOS 0 <26.6
Safari 0 <26.6

Affected Packages

euvd ios_and_ipados fix: 26.6
euvd macos fix: 26.6
euvd safari fix: 26.6
euvd visionos fix: 26.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The root cause is CWE-400 (Uncontrolled Resource Consumption), a class of flaw where a program fails to properly limit resource usage, here triggered through improper state management in Apple's WebKit rendering engine - the engine underlying Safari and all iOS/iPadOS/visionOS in-app browsers. CPE data confirms the affected surface: cpe:2.3:a:apple:safari, cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, and cpe:2.3:a:apple:visionos, all before version 26.6. Apple's fix description ('improved state management') suggests the engine failed to correctly track or release internal state during page rendering or script execution, allowing a malicious page to exhaust a resource and crash the hosting application.

Know when Visionos gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI 6.5 MEDIUM

Network-delivered via webpage visit (AV:N/AC:L), no authentication required (PR:N), but user must navigate to the site (UI:R); impact is crash-only with no data exposure (C:N/I:N/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 6.5 MEDIUM

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 28, 2026 - 16:22 NVD
6.5 (MEDIUM)
Patch available
Jul 27, 2026 - 21:17 EUVD
CVE Published
Jul 27, 2026 - 20:14 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 27, 2026 - 20:14 cve.org
MEDIUM 6.5

DescriptionCVE.org

This issue was addressed through improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. Visiting a website may lead to an app denial-of-service.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
High
Safari and iOS deployed across hundreds of millions of active Apple devices globally
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Visionos

View all
CVE-2025-31277 HIGH POC
8.8 Jul 30

WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
CVE-2025-43510 HIGH POC
7.8 Dec 12

Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
CVE-2025-24201 CRITICAL
10.0 Mar 11

A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
CVE-2025-43520 MEDIUM POC
5.5 Dec 12

Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
CVE-2024-44308 HIGH
8.8 Nov 20

Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
CVE-2025-14174 HIGH
8.8

Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such

CVE-2025-6558 HIGH
8.8

Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
CVE-2025-43529 HIGH
8.8 Dec 17

WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
CVE-2024-44309 MEDIUM
6.3 Nov 20

A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
CVE-2025-43200 MEDIUM
4.2 Jun 16

A denial of service vulnerability in This (CVSS 4.2). Risk factors: actively exploited (KEV-listed).
CVE-2024-27815 HIGH
7.8 Jun 10

An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
CVE-2026-43723 HIGH POC
7.8 Jul 27

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43804 ADVISORY https://seclists.org/oss-sec/2026/q3/521 ADVISORY https://vuldb.com/vuln/383679 REF https://support.apple.com/en-us/128066 REF https://support.apple.com/en-us/128067 REF https://support.apple.com/en-us/128070 REF https://support.apple.com/en-us/128073

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy