CVE-2026-43725

Normally, Safari and Apple’s web features keep risky web activity “inside a fence” so it can’t do much damage. This bug could let a malicious website slip past that fence to handle restricted web content. Think of it like a building’s restricted hallway getting a temporary door that shouldn’t open—so updates are important to close it.

This matters if your business uses Apple devices that browse the web with Safari (including iPhone, iPad, and Mac). The issue is triggered by a malicious website, with no authentication required, but user interaction (visiting the site) is required. It is only a risk when you (or someone on the device) opens the attacker-controlled website in the affected Safari/web browsing context.

This should be treated as an update priority because a malicious website can trigger the sandbox-bypass behavior, and the fix is already available for Safari/iOS/iPadOS/macOS 26.5.2. There’s no confirmed CISA KEV listing or clear dated press exploitation claim in the findings, and no public exploit code was found—however, the vulnerability involves web browsing, which is common in everyday business use.

1. Confirm exposure

• Identify all devices your business uses that rely on Safari for web browsing:
  • macOS (Safari)
  • iOS devices (Safari)
  • iPadOS devices (Safari/iPad)
• Check current OS versions on each device.

2. Apply the fix (target versions)

• Update to:
  • Safari 26.5.2
  • iOS 26.5.2
  • iPadOS 26.5.2
  • macOS Tahoe 26.5.2

3. Upgrade notes

• Plan for a device restart if prompted after updates.
• If your organization uses device management (MDM), ensure the managed app/OS update policy allows upgrading to the fixed release train.

4. Temporary workaround if patching is delayed

• Reduce exposure by avoiding untrusted links and especially any link shared unexpectedly (email, chat, SMS) until devices are updated.
• Keep Safari from being used for risky browsing activities on devices that have not yet been updated.

5. After updating

• Restart devices if required.
• Test Safari with a few normal business sites you commonly use to ensure browsing remains stable.

6. What to monitor

• Watch for Safari/web-related crashes or unusual browsing behavior after updates, and verify the update completed successfully across the fleet.

CISA KEV

• This issue is not listed in CISA KEV based on the provided findings.

Severity/impact basis: The weakness is sandbox escape/bypass behavior involving restricted web content processing. The vulnerability is described as improved input validation that corrects how the browser’s web content handling is validated.

Mechanism: A malicious website can bypass sandbox restrictions to process restricted web content outside the sandbox.

Authentication and interaction: No authentication is required, but user interaction is required (a user must visit/open the malicious website).

Exploitation status: The findings do not show a CISA KEV listing and do not include a clear dated claim of exploitation in press; no public exploit code was identified. Treat this as a real web-browsing risk due to the nature of the sandbox bypass, even though exploit maturity is not demonstrated in the findings.

Fix: Resolved in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.