CVE-2026-43745: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-43745 is an out-of-bounds write vulnerability in Apple's WebKit engine (specifically the WebKit Canvas component) that can cause an unexpected Safari crash when processing maliciously crafted web content. It was disclosed and patched on June 29, 2026, affecting Safari, iOS, iPadOS, and macOS Tahoe versions prior to 26.5.2. The vulnerability was discovered by OpenAI Codex Security (Amy Burnett) and Khai Tran, and is tracked under WebKit Bugzilla #315365. It carries a CVSS v3.1 base score of 6.5 (Medium) (Apple Advisory iOS/iPadOS, Apple Advisory Safari, Github Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write) and resides in the WebKit Canvas component. It arises from insufficient input validation when processing web content, allowing a write operation to occur outside the bounds of an intended buffer. Exploitation requires user interaction — specifically, a victim must visit or be directed to a malicious web page that serves crafted content triggering the flaw. The fix was implemented via improved input validation in WebKit (Apple Advisory iOS/iPadOS, Apple Advisory macOS, Github Advisory).

Note: Apple's official advisories describe the root cause as an out-of-bounds write, while the detailed patch notes for the same WebKit Bugzilla entry (313175) in the iOS/macOS advisories describe a use-after-free addressed with improved memory management — suggesting the NVD/GitHub description and the advisory patch notes may reflect slightly different characterizations of the same underlying issue.

Successful exploitation results in an unexpected crash of the Safari browser, constituting a denial-of-service condition for the affected user. The CVSS assessment confirms no confidentiality or integrity impact — only availability is affected. The scope is limited to the Safari process on the affected device; there is no evidence of code execution potential or lateral movement risk associated with this specific vulnerability (Github Advisory, Apple Advisory iOS/iPadOS).

Apple has released patches addressing this vulnerability in the following updates, all released June 29, 2026:

• Safari 26.5.2 (for macOS Sonoma and macOS Sequoia)
• iOS 26.5.2 and iPadOS 26.5.2 (for iPhone 11 and later, iPad Pro/Air/mini supported models)
• macOS Tahoe 26.5.2

Users should update their devices immediately via System Settings > General > Software Update (iOS/iPadOS/macOS) or the Mac App Store (Safari). As a temporary workaround prior to patching, users should avoid visiting untrusted or unknown websites (Apple Advisory iOS/iPadOS, Apple Advisory macOS, Apple Advisory Safari).

The June 29, 2026 Apple security update batch received notable media attention, partly due to the involvement of AI systems (OpenAI Codex Security and Anthropic's Claude) in discovering several of the patched WebKit vulnerabilities, including CVE-2026-43745. The Hacker News and Security Affairs covered the broader update, highlighting Apple's accelerated patch cycle and the role of AI-assisted vulnerability research (The Hacker News, Security Affairs). SC World reported that Apple cited AI-driven exploit acceleration as a motivation for releasing early security updates (SC World). The Zero Day Initiative published a review of the June 2026 Apple security updates (ZDI Blog).