CVE-2026-43720

This is a memory-handling bug in Safari. If someone tricks you into opening a malicious website, the browser may crash unexpectedly—like a program freezing because it tried to use “already discarded” internal data.

This matters if your business uses Apple devices where you browse the web with Safari (including iPhone, iPad, and Mac). The issue needs no login, but it does require you to open a malicious website—so it’s mainly a risk from browsing/visiting crafted pages on an unpatched system. The findings don’t confirm whether it’s reachable in default configuration beyond “user opens” a malicious page.

This is a real, user-triggered crash issue, but there’s no evidence provided of widespread exploitation in the findings. Since it can be triggered by visiting a malicious site and the fix is available, you should update promptly, especially on devices used for business-critical browsing.

1. Inventory affected endpoints:

• Identify Mac systems running Safari and the relevant macOS version.
• Identify iPhone/iPad systems running iOS/iPadOS and the relevant Safari version (via OS level).

2. Confirm exposure:

• If your devices are not on Safari 26.5.2 (Mac) or iOS/iPadOS 26.5.2 (iPhone/iPad), you are exposed to the crash behavior from maliciously crafted web content.
• The issue requires a user to open a malicious website; devices that never open untrusted links are at lower day-to-day risk, but the practical risk is still present for normal browsing.

3. Upgrade to the fixed versions:

• Update Safari to 26.5.2 on macOS.
• Update iOS and iPadOS to 26.5.2.
• Update macOS to Tahoe 26.5.2.

4. Temporary workaround if you can’t patch immediately:

• Reduce exposure by avoiding links from unknown senders, being cautious with unexpected messages, and not opening newly discovered/untrusted websites.
• If a malicious site is suspected, don’t revisit it until updated.

5. After updating, what to monitor:

• Verify Safari/iOS/iPadOS updates completed successfully.
• If Safari still crashes when opening a particular site, stop using that site and report it internally as a potential malicious page.

CVE-2026-43720 is a use-after-free vulnerability (CWE-416) in Safari’s processing of maliciously crafted web content. The impact described in the findings is a Safari crash when the user opens a hostile page; there is no indication in the findings of data theft or unauthorized actions.

Findings summary:

• Exploitation in the wild: not listed in CISA KEV; no clear dated press claim; no public exploit code on record.
• Patch: fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.
• Attack conditions: no authentication required, but user interaction is required (the user must open the malicious web page).

KEV and EPSS were not provided as findings here, and therefore are not used to drive urgency in this report.