CVE-2025-43535: 
Apple Safari vulnerability analysis and mitigation

CVE-2025-43535 is a use-after-free vulnerability in Apple's WebKit browser engine that can be triggered by processing maliciously crafted web content, potentially leading to an unexpected process crash. It affects iOS and iPadOS before 18.7.3 and before 26.2, macOS Tahoe before 26.2, visionOS before 26.2, and Safari before 26.2. The vulnerability was disclosed on December 12, 2025, when Apple released patches, and was formally published in the NVD on December 17, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium), as assessed by CISA-ADP (Apple Advisory iOS 26.2, Apple Advisory iOS 18.7.3).

The root cause is a use-after-free (CWE-416) flaw in WebKit's memory management, addressed via improved memory handling (WebKit Bugzilla: 300774). An attacker can exploit this by luring a target to visit a maliciously crafted webpage, causing the WebKit rendering engine to access previously freed memory during web content processing. No authentication or elevated privileges are required; only user interaction (visiting a malicious page) is needed. The vulnerability was discovered by Google Big Sleep and Nan Wang (@eternalsakura13), and it is closely related to CVE-2025-43529 and CVE-2025-14174, which were issued in response to the same sophisticated attack report (Apple Advisory iOS 26.2, Apple Advisory iOS 18.7.3).

Successful exploitation can cause an unexpected process crash in the WebKit-based browser or app rendering web content. While the NVD-assigned CVSS score reflects only availability impact (process crash), Apple's advisory for the related companion vulnerability (CVE-2025-43529) notes that the broader attack campaign — of which CVE-2025-43535 is a component — may lead to arbitrary code execution on targeted devices. The vulnerability affects a wide range of Apple devices running iOS, iPadOS, macOS, visionOS, and Safari, and was reportedly used in an extremely sophisticated targeted attack against specific individuals on iOS versions before iOS 26 (Apple Advisory iOS 18.7.3, Apple Advisory visionOS 26.2).

Apple has released patches addressing CVE-2025-43535 across all affected platforms. Users should update to the following versions or later: iOS 18.7.3 and iPadOS 18.7.3 (for older devices), iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, and Safari 26.2. No configuration-based workaround is available; updating to a patched version is the only recommended remediation. Given the confirmed use in a sophisticated targeted attack, organizations and high-risk individuals should prioritize immediate patching (Apple Advisory iOS 18.7.3, Apple Advisory iOS 26.2, Apple Advisory macOS Tahoe 26.2).

Apple acknowledged the vulnerability in its December 12, 2025 security advisories, noting awareness of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. Google Big Sleep (Google's AI-assisted vulnerability research team) and Nan Wang (@eternalsakura13) were credited with discovery, highlighting the role of AI-assisted security research in finding WebKit flaws. Coverage appeared across technology media outlets including 9to5Mac and Lifehacker, and the vulnerability was tracked by security platforms including Tenable, Qualys, and CIS (Apple Advisory iOS 26.2, CIS Advisory).