CVE-2025-46299: 
Apple Safari vulnerability analysis and mitigation

CVE-2025-46299 is a memory initialization vulnerability in Apple's WebKit engine that may allow processing maliciously crafted web content to disclose internal states of the application. It was discovered by Google Big Sleep and disclosed by Apple on December 12, 2025, with an updated advisory entry added January 9, 2026. The vulnerability affects Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS — all versions prior to the 26.2 release. It carries a CVSS v3.1 base score of 4.3 (Medium) (Apple Safari Advisory, Apple iOS/iPadOS Advisory).

The root cause is a memory initialization issue in WebKit (CWE-284: Improper Access Control), tracked internally at WebKit Bugzilla #299518. An attacker can exploit this by delivering maliciously crafted web content — such as a specially constructed webpage — that triggers the uninitialized memory condition, potentially leaking internal application state to the attacker. Exploitation requires user interaction (e.g., visiting a malicious page), and no authentication is needed. The vulnerability was reported by Google Big Sleep, a Google research team focused on AI-assisted vulnerability discovery (Apple tvOS Advisory, Apple macOS Advisory).

Successful exploitation results in a limited confidentiality impact: internal application states may be disclosed to a remote attacker when a user processes maliciously crafted web content. There is no integrity or availability impact. The scope is limited to the affected application (e.g., Safari or WebKit-based apps), and there is no evidence of lateral movement potential or significant data exfiltration risk beyond application state leakage (Apple Safari Advisory, Apple iOS/iPadOS Advisory).

Apple has addressed this vulnerability in the following releases: Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2 — all released December 12, 2025. Users and administrators should update all affected Apple devices to these versions or later. No configuration-based workarounds have been published; upgrading to the patched release is the only recommended remediation (Apple Safari Advisory, Apple iOS/iPadOS Advisory, Apple macOS Advisory).

The vulnerability was credited to Google Big Sleep, Google's AI-assisted vulnerability research project, which has attracted attention as a demonstration of AI-driven security research discovering real-world browser engine flaws. The broader security community noted that CVE-2025-46299 was patched alongside more severe WebKit vulnerabilities (CVE-2025-43529 and CVE-2025-14174) that Apple confirmed were actively exploited in sophisticated targeted attacks, making the December 2025 WebKit update particularly significant. Downstream Linux distributions including SUSE, Fedora, Debian, Ubuntu, Red Hat, and Rocky Linux subsequently issued webkit2gtk/webkitgtk security advisories incorporating this fix (Apple Safari Advisory, Apple tvOS Advisory).