CVE-2026-43746: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-43746 is a use-after-free vulnerability in Apple's WebKit engine that can cause an unexpected Safari crash when processing maliciously crafted web content. It was disclosed and patched on June 29, 2026, affecting Safari versions prior to 26.5.2, iOS and iPadOS prior to 26.5.2, and macOS Tahoe prior to 26.5.2. The vulnerability was discovered by researcher "dr3dd" and is tracked under WebKit Bugzilla entry 314090. It carries a CVSS v3.1 base score of 6.5 (Medium) (Apple Advisory iOS/iPadOS, Apple Advisory macOS, Github Advisory).

The vulnerability is classified as CWE-416 (Use After Free), occurring within the WebKit browser engine used by Safari. The flaw arises from improper memory management where a memory region is freed but subsequently referenced, creating a dangling pointer condition that can be triggered by processing specially crafted web content. Exploitation requires user interaction — specifically, a victim must visit or be directed to a malicious webpage — and no authentication or special privileges are required on the attacker's side. Apple addressed the issue with improved memory management in the patched releases (Apple Advisory macOS, Github Advisory).

Successful exploitation results in an unexpected crash of the Safari browser, constituting a denial-of-service condition. The CVSS scoring reflects a high availability impact with no confidentiality or integrity impact, meaning the vulnerability does not expose user data or allow unauthorized modification of content in its current known form. The affected scope is limited to the Safari browser process on iOS, iPadOS, and macOS Tahoe devices running versions prior to 26.5.2 (Apple Advisory iOS/iPadOS, Apple Advisory Safari).

Apple has released patches addressing this vulnerability in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, and macOS Tahoe 26.5.2, all released on June 29, 2026. Users should update their devices via Software Update (iOS/iPadOS/macOS) or update Safari through the Mac App Store. As a precautionary measure, users should avoid visiting untrusted websites or clicking suspicious links until the update is applied (Apple Advisory iOS/iPadOS, Apple Advisory macOS, Apple Advisory Safari).

Coverage of the June 29, 2026 Apple security update round was noted by consumer technology outlets including Lifehacker, which highlighted the broader set of security flaws patched in the iOS 26.5.2 update. The SANS Internet Storm Center also published a diary entry covering the Apple security updates released on this date. The Zero Day Initiative (ZDI) published a review of the June 2026 Apple security updates, providing broader context for the patch batch that included CVE-2026-43746 (Lifehacker, SANS ISC, ZDI Blog).