CVE-2026-43715

No known exploitation. EPSS puts it in the 32nd percentile. A vendor fix is available.

CVSS 3.18.8High EPSS percentile32nd0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-06-29Updated 2026-09-14Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which devices and OS/browser versions your business uses (Safari on macOS, and Safari in iOS/iPadOS).
Update Safari to 26.5.2 on affected macOS versions.
Update iOS and iPadOS to 26.5.2 on affected iPhone/iPad devices.
Ensure users avoid opening unknown links until updates are applied, especially from email or chat messages.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption.

In plain language

Written by AI from the record

A serious Safari/iPhone/iPad/Mac browser bug lets a website potentially crash the browser or run code if you visit a specially crafted page; small businesses should update to the fixed versions.

CVE-2026-43715 is a use-after-free vulnerability (CWE-416) in Safari’s handling of maliciously crafted web content, allowing memory corruption that can lead to arbitrary code execution or crashes when a user opens a crafted webpage; it is fixed in Safari 26.5.2, iOS/iPadOS 26.5.2, and macOS Tahoe 26.5.2.

If you're affected

Browser takeover via malicious page
Device compromise through Safari
Business disruption from crashes
Potential theft of sensitive data

What is it

This is a “use-after-free” bug, which means Safari can get tricked into using memory that was already freed. A malicious website could exploit that to crash the browser or possibly run code. Think of it like reading from a computer file that has already been deleted—if the timing is right, it can lead to unpredictable behavior.

Who is affected

This matters if your staff use Safari to browse the web on Apple devices (Safari on macOS, and Safari on iPhone/iPad). The risk comes from a malicious website: there’s no need for the attacker to break into your account first, but a user must visit a crafted webpage. Only exposure is meaningful if Safari on those devices is reachable by typical web browsing (i.e., the user can open web content in Safari).

How urgent is it

Treat this as urgent but not emergency-level for all users: there’s no confirmed CISA KEV listing and no public exploit code noted in the provided findings. However, the flaw is high severity and has a realistic path to impact through a user opening a malicious webpage, so you should patch promptly. Since the traffic-light verdict is AMBER, plan to update quickly and restrict risky browsing in the meantime.

What to do — in detail

Confirm exposure (what to check)
- Identify every device your business uses that can run Safari: macOS machines (Safari in macOS) and iPhone/iPad devices (Safari in iOS/iPadOS).
- Record each device’s OS version and Safari version.
- Any device running Safari/iOS/iPadOS/macOS versions older than the fixed releases is potentially affected.
Upgrade to the fixed versions
- macOS: upgrade so Safari on macOS is at 26.5.2 (fixed in 26.5.2 for macOS Tahoe 26.5.2).
- iPhone/iPad: upgrade iOS and iPadOS so Safari is at 26.5.2 (fixed in 26.5.2 for iOS 26.5.2 and iPadOS 26.5.2).
If patching is delayed (workarounds)
- Reduce the chance users visit malicious pages: tighten email/chat link handling and discourage opening unexpected links.
- Limit browsing from untrusted sources on affected devices until updates are completed.
After updating (what to monitor)
- Confirm devices successfully updated to the target versions.
- If you have centralized logging/MDM, check for Safari crash spikes that occurred before updates and confirm they stop afterward.

Technical context

Severity is high, and the weakness is CWE-416 (use-after-free). The mechanism is memory corruption during the processing of maliciously crafted web content, triggered by user interaction (visiting a specially crafted webpage). The provided findings indicate no CISA KEV listing, no clear dated press claims of exploitation, and no public exploit code on record; the fix is available in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. With no confirmed exploitation indicators in the provided sources but a high-impact technical flaw, the recommended posture aligns with the AMBER verdict.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS32nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 32nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 77 days, from the signal feeds we watch.

2026-09-14Patch availablerecord updated
2026-07-27Patch availablerecord updated
2026-07-15OpenVAS check added
2026-06-30Patch availablerecord updated
2026-06-29Publishedweakness classified, att&ck mapped

Affected products

Applecommercial · USaka apple inc., apple computer
- SafariDesktop AppOn-premConsumer Software / browser
- ipadosOSEmbeddedOperating Systems / mobile-os
- iOS and iPadOSOSEmbeddedOperating Systems / mobile-os
- macOSOSOn-premOperating Systems / unix-bsd
- tvOSOSEmbeddedOperating Systems / mobile-os
- visionOSOSOperating Systems / mobile-os
- watchOSOSEmbeddedOperating Systems / mobile-os

And 3 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable