CVE-2026-43670: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-43670 is a Content Security Policy (CSP) bypass vulnerability in Apple's WebKit engine, specifically within AudioWorklet contexts. Processing maliciously crafted web content can cause CSP enforcement to be bypassed, potentially allowing injection of unauthorized scripts or resources. The vulnerability affects Safari (all versions before 26.5), iOS and iPadOS (before 18.7.9 and before 26.5), and macOS Tahoe (before 26.5). It was disclosed by Apple on May 11, 2026, with NVD analysis published August 25, 2026, and was discovered by lebr0nli of National Yang Ming Chiao Tung University, Security and Systems Lab. It carries a CVSS v3.1 base score of 8.8 (High) (Apple iOS 26.5 Advisory, Apple iOS 18.7.9 Advisory, Apple macOS Advisory, Apple Safari Advisory).

The vulnerability is classified as CWE-693 (Protection Mechanism Failure), arising from insufficient enforcement of Content Security Policy within AudioWorklet contexts in WebKit (WebKit Bugzilla: 309004). AudioWorklet is a Web Audio API feature that runs audio processing scripts in a dedicated thread; the flaw allowed CSP directives to be bypassed when processing web content in this context. Apple addressed the issue with improved enforcement in AudioWorklet contexts. Exploitation requires user interaction — a victim must visit or process maliciously crafted web content — but no authentication or special privileges are required from the attacker (Apple iOS 26.5 Advisory, Apple macOS Advisory).

Successful exploitation allows an attacker to bypass Content Security Policy protections, potentially enabling injection of unauthorized scripts or resources into a victim's browser session. This could facilitate cross-site scripting (XSS) attacks, data exfiltration, or loading of malicious third-party content that CSP was intended to block. The CVSS assessment indicates high confidentiality, integrity, and availability impact, though the technical impact is assessed as partial by NVD's SSVC analysis, and the scope is unchanged (contained to the browser context) (Apple iOS 26.5 Advisory, Apple Safari Advisory).

There is no evidence of public proof-of-concept code or active in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.132%, indicating a low probability of exploitation in the near term. Exploitation is not automatable (requires user interaction) and NVD's SSVC assessment confirms no known exploitation (Apple iOS 26.5 Advisory).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to the following versions or later: Safari 26.5 (released May 13, 2026), iOS 26.5 and iPadOS 26.5 (released May 11, 2026), iOS 18.7.9 and iPadOS 18.7.9 (released May 11, 2026), and macOS Tahoe 26.5 (released May 11, 2026). No configuration-based workarounds have been published; upgrading to a patched version is the recommended remediation. Organizations should prioritize patching internet-facing and user-facing Apple devices (Apple iOS 26.5 Advisory, Apple iOS 18.7.9 Advisory, Apple macOS Advisory, Apple Safari Advisory).