CVE-2026-43716

This bug is like a weakness in how Safari handles data from web pages. If a user opens a specially crafted web page, Safari can crash. In a business setting, that can mean interrupted work (tabs close, forms may be lost) and short downtime while the browser restarts.

This matters if you use Apple devices where Safari is your browser (Safari on macOS, iOS, and iPadOS). An attacker can’t trigger the crash without a user doing something—processing malicious web content—so risk is tied to browsing and clicking/opening content.

This is only a risk if malicious web content is reachable to a user (for example, via a link or page a staff member or customer is prompted to open).

This issue is not known to be exploited in the wild based on the provided findings, and there is no public exploit code on record. Even so, it directly affects Safari stability and requires no authentication, meaning a real attacker can still target users through browsing.

Treat it as a prompt update: install the fixed Safari/iOS/macOS versions as soon as you can during your next maintenance window (or sooner if your business relies heavily on Safari).

Confirm exposure (you likely are):

• Determine whether you’re running affected Apple platforms:
  • Safari on macOS
  • Safari on iOS
  • Safari on iPadOS
• Check your OS version:
  • On macOS: System Settings → General → About (confirm you’re on “Tahoe” and what version/build you have).
  • On iOS/iPadOS: Settings → General → About (confirm the version).
• Because the fix is delivered via the OS, the key check is whether you’re updated to the fixed OS versions (Safari 26.5.2 / iOS 26.5.2 / iPadOS 26.5.2 / macOS Tahoe 26.5.2).

Upgrade / fixed versions:

• Update to:
  • Safari 26.5.2
  • iOS 26.5.2
  • iPadOS 26.5.2
  • macOS Tahoe 26.5.2

Breaking-change notes:

• None are provided in the findings. Expect standard OS update behavior (restart may be required).

If you can’t patch immediately (workaround):

• Reduce exposure by avoiding suspicious links and untrusted downloads/pages.
• If a particular browser-based workflow is mission-critical, temporarily verify it using alternative internal browsers while you schedule the Safari/OS update.

After updating, monitor:

• Watch for Safari crash reports or repeated restart behavior from users.
• If you manage device fleets, confirm all devices moved to the fixed OS versions listed above.

CISA due date:

• Not provided (this CVE is not listed in CISA KEV in the findings).

Severity and nature:

• The reported impact is availability-related: Safari may crash (denial of service) when processing maliciously crafted web content.

Weakness type:

• CWE-119 (improper restriction of operations within the bounds of memory) and CWE-416 (use-after-free) are cited, and the patch note indicates improved memory handling.

Attack conditions / vector:

• Attack vector is network, and no authentication is required.
• User interaction is required: a user must process (open/visit) the malicious web content.

Exploitation status:

• CISA KEV: not listed.
• Press/exploitation: no clear dated claim provided.
• Public exploit code: none on record.

Fix availability:

• Fixed versions are stated as Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.

What KEV would mean here:

• KEV indicates known exploitation with confirmation; since it is not listed, confirmed exploitation is not indicated by the provided findings.