Skip to main content

Apple Safari EUVDEUVD-2026-40192

| CVE-2026-43725 HIGH
Improper Input Validation (CWE-20)
2026-06-29 apple GHSA-qxph-q4j6-rfqr
Information Disclosure Apple Ios And Ipados
7.1
CVSS 3.1 · Vendor: apple
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure victim to malicious website
  2. Delivery
    Serve crafted web content
  3. Exploit
    WebKit fails input validation
  4. Execution
    Restricted content processed outside sandbox
  5. Impact
    Access data beyond sandbox boundary

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions

Exploitation requires the victim to actively visit or load an attacker-controlled malicious website in an unpatched Safari/WebKit browser (UI:R); there is no authentication requirement (PR:N) and no special victim-side configuration beyond running a version below 26.5.2 of Safari, iOS/iPadOS, or macOS. The factors that limit real-world risk are the mandatory user interaction (the attacker cannot trigger it without the user opening the content), the restriction to Apple's WebKit engine (so non-Safari/non-WebKit browsing on other platforms is unaffected), and the LOW impact ceiling (the bug processes 'restricted web content' outside the sandbox - an isolation/disclosure bypass, not arbitrary code execution).
Impact

Signals are moderate and internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1 High) indicates a network-reachable, low-complexity, unauthenticated attack that nonetheless requires user interaction (visiting a malicious site) and yields only LOW impact on each of confidentiality, integrity, and availability - consistent with a partial sandbox-isolation bypass / information disclosure (per the 'Information Disclosure' tag) rather than full code execution. No EPSS score and no SSVC decision data were provided in the input, so exploitation probability and automatability cannot be quantified here. It is NOT in CISA KEV and no POC is referenced, so this is 'no public exploit identified at time of analysis' - a high-priority patch item given the enormous install base and pre-auth network vector, but not an emergency-grade actively-exploited bug. The mandatory user interaction and the LOW (not HIGH) impacts temper real-world severity below what the High label alone implies. Caveat: the 'restricted web content' phrasing is vague about exactly what data crosses the sandbox boundary.
Exploit ScenarioDerived

An attacker hosts a malicious web page and lures a victim into opening it via a phishing link, malvertising, or a compromised site. When the unpatched Safari/WebKit renderer parses the crafted content, improper input validation lets the page process restricted web content outside the sandbox, exposing data or resources that should be isolated from the untrusted page. No public exploit is currently identified, and the attack only succeeds if the user actually loads the malicious content.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 29, 2026

Sandbox escape in Apple's WebKit browser engine (Safari, iOS/iPadOS, and macOS Tahoe before 26.5.2) lets a malicious website process restricted web content outside the browser sandbox, undermining the isolation that confines untrusted web pages. The flaw stems from improper input validation (CWE-20), was reported by Apple itself, and requires a victim to visit attacker-controlled content (UI:R); CVSS 7.1 reflects limited confidentiality, integrity, and availability impact across a changed scope. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

RemediationAI

Vendor-released patch: update to Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, or macOS Tahoe 26.5.2, which Apple states fixes the issue via improved input validation; apply via Settings/Software Update or the App Store per Apple advisories https://support.apple.com/en-us/127594, https://support.apple.com/en-us/127595, and https://support.apple.com/en-us/127685. Because exploitation requires the victim to load malicious web content, interim compensating controls until patching include enabling Lockdown Mode on iOS/iPadOS/macOS, which aggressively restricts WebKit content handling at the cost of disabling some web features and rich media, and using web/DNS filtering to block known-malicious domains, which adds latency and can cause false positives. There is no feature toggle specific to this flaw, so prompt patching is the only complete fix.

Affected VersionsENISA

Safari 0 <26.5.2
iOS and iPadOS 0 <26.5.2
macOS 0 <26.5.2

Affected Packages

euvd ios_and_ipados fix: 26.5.2
euvd macos fix: 26.5.2
euvd safari fix: 26.5.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is Apple's WebKit rendering engine, which powers Safari on macOS and is the mandated browser engine on iOS and iPadOS, so the same defect surfaces across all three platforms (CPEs apple:safari, apple:ios_and_ipados, apple:macos). WebKit confines untrusted web content inside a sandboxed WebContent process so that even malicious JavaScript/HTML cannot reach the broader OS or other origins. The root cause is CWE-20 (Improper Input Validation): WebKit failed to properly validate certain input, allowing 'restricted web content' to be processed outside the intended sandbox boundary. This maps to the CVSS scope change (S:C) - the vulnerable sandboxed renderer affects resources beyond its security authority. Apple's fix note ('addressed with improved input validation') confirms a validation-class root cause rather than a memory-safety/corruption bug.

Know when Ios And Ipados gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
vuln.today AI 7.1 HIGH

Web content is network-delivered (AV:N), low complexity, no auth (PR:N) but needs the victim to open the page (UI:R); the sandbox escape changes scope (S:C) with limited low impact across C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.1 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

4
CVSS changed
Jun 29, 2026 - 22:22 NVD
7.1 (HIGH)
Patch available
Jun 29, 2026 - 22:02 EUVD
CVE Published
Jun 29, 2026 - 19:42 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 29, 2026 - 19:42 cve.org
HIGH 7.1

DescriptionCVE.org

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious website may be able to process restricted web content outside the sandbox.

Executive ViewAI

Why It Matters

Apple WebKit sandbox escape (CVE-2026-43725) affecting Safari on iOS, iPadOS, and macOS Tahoe allows malicious websites to execute code outside browser isolation, creating elevated compromise risk across the Apple device ecosystem. The attack requires only that users visit attacker-controlled content, with no technical barriers or special conditions needed, affecting any employee using Safari on company or personal Apple devices.

Business Impact: High
Compensating Controls

Apply vendor patch: Safari/macOS Tahoe 26.5.2 and corresponding iOS/iPadOS updates. If immediate patching is blocked, restrict affected Safari browsers to curated internal sites only until patch deployment is complete.

Threat Intelligence Overview

EPSS Score
0.3%
Top 77% exploitable
Prevalence
Ubiquitous
Safari/WebKit ships on billions of Apple iOS, iPadOS, and macOS devices
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Ios And Ipados

View all
CVE-2026-86950 HIGH POC
8.8 Sep 28

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
CVE-2026-43723 HIGH POC
7.8 Jul 27

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
CVE-2026-28952 HIGH POC
7.5 May 11

Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
CVE-2026-65414 CRITICAL
9.8 Sep 14

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
CVE-2026-64771 CRITICAL
9.8 Jul 27

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
CVE-2026-43803 CRITICAL
9.8 Jul 27

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
CVE-2026-43810 CRITICAL
9.8 Jul 27

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
CVE-2026-64770 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
CVE-2026-64769 CRITICAL
9.8 Jul 27

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
CVE-2026-64774 CRITICAL
9.8 Jul 27

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
CVE-2026-64772 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
CVE-2026-84561 CRITICAL
9.8 Sep 14

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:42062 ADVISORY https://access.redhat.com/errata/RHSA-2026:42088 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43725 ADVISORY https://vuldb.com/vuln/374748 REF https://support.apple.com/en-us/127594 REF https://support.apple.com/en-us/127595 REF https://support.apple.com/en-us/127685 REF https://support.apple.com/en-us/128068 REF https://support.apple.com/en-us/128069 REF https://support.apple.com/en-us/128070 REF https://support.apple.com/en-us/148287

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy