CVE-2026-43742: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-43742 is a path handling vulnerability in Apple's WebKit engine that may allow maliciously crafted web content to disclose sensitive user information. It was disclosed and patched on June 29, 2026, affecting Safari versions prior to 26.5.2, iOS and iPadOS prior to 26.5.2, and macOS Tahoe prior to 26.5.2. The vulnerability was discovered by Юлия Мерцалова (Yulia Mertsalova) and is tracked under WebKit Bugzilla #313085. It carries a CVSS v3.1 base score of 6.5 (Medium) (Apple iOS Advisory, Apple macOS Advisory, Apple Safari Advisory, Github Advisory).

The vulnerability is classified as CWE-416 (Use After Free) per NVD and GitHub Advisory Database, though Apple's own advisories describe it specifically as a path handling issue in WebKit that was addressed with improved validation (WebKit Bugzilla: 313085). The attack vector is network-based and requires user interaction — a victim must visit or process maliciously crafted web content in a vulnerable browser or WebView. No privileges are required on the part of the attacker, and exploitation is not automated. No public technical write-ups or proof-of-concept code have been identified at this time (Apple iOS Advisory, Apple macOS Advisory, Github Advisory).

Successful exploitation may result in the disclosure of sensitive user information from within the WebKit rendering process, representing a confidentiality impact. The CVSS scoring reflects high availability impact (process crash) and no integrity impact, though Apple's advisory specifically characterizes the consequence as information disclosure. The scope is limited to the affected component (unchanged scope), and there is no evidence of lateral movement potential or data modification capability associated with this vulnerability (Apple iOS Advisory, Apple macOS Advisory, Github Advisory).

Apple has released patches addressing this vulnerability in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, and macOS Tahoe 26.5.2, all released on June 29, 2026. Users should update their devices and browsers to these versions or later immediately via System Settings > General > Software Update (iOS/macOS) or the Mac App Store (Safari on older macOS). As a precautionary measure prior to patching, users should avoid visiting untrusted or unknown websites. No configuration-based workarounds have been published by Apple (Apple iOS Advisory, Apple macOS Advisory, Apple Safari Advisory).

The June 29, 2026 Apple security update batch — which included CVE-2026-43742 among dozens of other WebKit and system-level fixes — received coverage from technology media outlets including Lifehacker, which advised users to update their iPhones promptly. The SANS Internet Storm Center published a diary entry (ISC Diary #33114) covering the broader Apple update release. The Zero Day Initiative (ZDI) published a June 2026 Apple Security Update Review covering the patch batch. No specific researcher commentary focused exclusively on CVE-2026-43742 has been identified (Lifehacker, SANS ISC, ZDI Blog).