CVE-2026-43735: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-43735 is a cross-origin data exfiltration vulnerability in Apple's WebKit engine that allows a malicious website to read and potentially modify data belonging to a different origin. It affects Safari before 26.5.2, iOS and iPadOS before 26.5.2, and macOS Tahoe before 26.5.2. The vulnerability was disclosed and patched on June 29, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Apple Advisory - macOS, Github Advisory).

The vulnerability resides in WebKit (tracked as WebKit Bugzilla #313357) and stems from insufficient boundary checks that fail to properly enforce the same-origin policy, classified as CWE-352 (Cross-Site Request Forgery) by NVD, though the practical mechanism involves cross-origin information leakage via the NavigateEvent.sourceElement API. A public PoC demonstrates that an attacker-controlled page can access and manipulate the DOM of a victim page loaded in a different origin by exploiting this improper check. Exploitation requires user interaction — specifically, a victim must visit the attacker's malicious website using a vulnerable Safari/WebKit browser. The fix was described by Apple as "improved checks" (Apple Advisory - iOS/iPadOS, Apple Advisory - Safari, Github Advisory).

Successful exploitation allows an unauthenticated attacker to exfiltrate sensitive data — such as email addresses and account IDs — from cross-origin web pages viewed by the victim in Safari. The CVSS scoring reflects high confidentiality and integrity impact, meaning an attacker can both read and potentially modify cross-origin page content. The vulnerability is limited to the browser context and does not directly enable OS-level code execution or lateral movement, but stolen session data or credentials could facilitate further account compromise (Apple Advisory - macOS, Github Advisory).

1. Setup attacker infrastructure: Host two pages on separate domains — attacker.html on an attacker-controlled domain and victim.html on a domain simulating a target service (e.g., using Vercel or similar hosting).
2. Lure the victim: Trick the target user into visiting attacker.html in a vulnerable version of Safari (prior to 26.5.2) via phishing, malvertising, or a malicious link.
3. Trigger cross-origin navigation: The attacker page initiates a navigation or interaction that causes the victim's browser to load or reference the victim-origin page, exploiting the NavigateEvent.sourceElement property which incorrectly exposes cross-origin DOM references.
4. Access cross-origin DOM: Using the improperly exposed sourceElement reference, the attacker's JavaScript reads sensitive data from the victim page's DOM (e.g., email address, account ID, session tokens displayed on the page).
5. Exfiltrate data: The stolen data is sent to an attacker-controlled server via a fetch or XMLHttpRequest call from the attacker page (Github PoC, Apple Advisory - iOS/iPadOS).

• Network: Outbound HTTP/HTTPS requests from a Safari browser session to unexpected third-party domains immediately after visiting an unfamiliar website; requests carrying encoded user data (e.g., email, account IDs) in query parameters or POST bodies to attacker-controlled endpoints.
• Logs: Web server access logs on victim-side services showing unusual cross-origin referrer headers or navigation events originating from unrelated domains.
• Browser Behavior: Unexpected page navigations or iframes loading cross-origin content without user initiation while browsing in Safari on affected platforms.
• File System: No known file system artifacts, as exploitation is entirely browser/memory-resident.

Apple has released patches addressing this vulnerability in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, and macOS Tahoe 26.5.2, all released on June 29, 2026. Users should update their devices immediately via System Settings > General > Software Update (iOS/macOS) or the Mac App Store (Safari on older macOS). No configuration-based workaround is available; upgrading to the patched version is the only effective remediation. As an interim measure, users on unpatched systems should avoid visiting untrusted websites in Safari (Apple Advisory - iOS/iPadOS, Apple Advisory - macOS, Apple Advisory - Safari).

The SANS Internet Storm Center published a diary entry covering the June 2026 Apple security updates, noting the breadth of WebKit fixes in this release (SANS ISC). The Zero Day Initiative (ZDI) published a review of the June 2026 Apple security update batch, highlighting the large number of WebKit vulnerabilities addressed (ZDI Blog). Lifehacker and other consumer tech outlets covered the update broadly, urging iPhone and Mac users to patch promptly (Lifehacker).