CVE-2025-43536: 
Apple Safari vulnerability analysis and mitigation

CVE-2025-43536 is a use-after-free vulnerability in Apple's WebKit browser engine that can cause an unexpected process crash when processing maliciously crafted web content. It affects iOS and iPadOS before 18.7.3, iOS 26.x and iPadOS 26.x before 26.2, Safari before 26.2, and macOS Tahoe before 26.2. The vulnerability was discovered by Nan Wang (@eternalsakura13) and disclosed by Apple on December 12, 2025, with the CVE record published on December 17, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium), as assessed by CISA-ADP (Apple iOS 26.2 Advisory, Apple iOS 18.7.3 Advisory, Apple Safari 26.2 Advisory).

The vulnerability is classified as CWE-416 (Use After Free), occurring within WebKit's memory management subsystem (WebKit Bugzilla: 301726). A use-after-free condition arises when WebKit accesses a memory region that has already been freed during the processing of maliciously crafted web content, leading to an unexpected process crash. Exploitation requires user interaction — specifically, a victim must visit or be directed to a malicious web page — and no authentication or special privileges are required on the attacker's side. The flaw was addressed by Apple through improved memory management in the affected WebKit component (Apple iOS 26.2 Advisory, Apple macOS Tahoe 26.2 Advisory).

Successful exploitation of CVE-2025-43536 can lead to an unexpected process crash in the WebKit rendering process, which may be leveraged as a stepping stone toward arbitrary code execution in a chained exploit scenario. The vulnerability is co-reported alongside CVE-2025-43529 and CVE-2025-14174, which were confirmed by Apple to have been exploited in extremely sophisticated targeted attacks against specific individuals on iOS versions before iOS 26; CVE-2025-43536 itself is part of the same broader attack surface. The primary availability impact is a process crash, but in a chained exploit context, confidentiality and integrity of the affected device could be at risk (Apple iOS 18.7.3 Advisory, Apple iOS 26.2 Advisory).

Apple has released patches addressing CVE-2025-43536 across all affected platforms. Users should update to the following versions or later:

• iOS and iPadOS: 18.7.3 (for older devices) or 26.2
• macOS: Tahoe 26.2
• Safari: 26.2 (for macOS Sonoma and macOS Sequoia)

No configuration-based workaround is available; updating to a patched version is the only recommended remediation. Given the co-occurrence with actively exploited WebKit vulnerabilities in the same release, immediate patching is strongly advised (Apple iOS 18.7.3 Advisory, Apple iOS 26.2 Advisory, Apple Safari 26.2 Advisory, Apple macOS Tahoe 26.2 Advisory).

The December 12, 2025 Apple security update batch received notable attention due to the simultaneous disclosure of CVE-2025-43529 and CVE-2025-14174, which Apple confirmed were exploited in sophisticated targeted attacks. Security media outlets including 9to5Mac and Lifehacker covered the update, emphasizing the urgency of patching iOS devices. The CIS Security advisory also flagged the batch as addressing multiple vulnerabilities that could allow arbitrary code execution across Apple products. CVE-2025-43536 itself received less individual attention than its co-disclosed counterparts, but was noted as part of a significant WebKit security update (9to5Mac, CIS Advisory).