CVE-2025-43529

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-43529 8.8

Apple · Multiple Products · Added 2025-12-15 · Published 2025-12-17

3-Day Required KEV Active Exploitation

Details

VulnerabilityApple Multiple Products Use-After-Free WebKit Vulnerability

VendorApple

ProductMultiple Products

Date added2025-12-15

Due date2026-01-05

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-416

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Descriptions

KEV: Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

NVD: A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-06-16 22:03 UTC

Wall time45s

Searches3

Component defaultyes

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Monitor for maliciously crafted web content triggering use-after-free in Apple WebKit, leading to arbitrary code execution on Safari and unpatched Apple devices.

Research details

ComponentApple WebKit (WebKit Browser Engine - HTML/Web content processing)

PreconditionsUser interaction required: target must visit a maliciously crafted URL or open malicious web content in a WebKit-based browser (Safari, or any app using WKWebView/UIWebView); User must be using a vulnerable OS version: Safari 26.2, iOS/iPadOS 18.7.3 or earlier, iOS/iPadOS 26.2 or earlier, macOS Tahoe 26.2 or earlier, macOS Sonoma 14.8.3 or earlier, macOS Sequoia 15.7.3 or earlier, tvOS 26.2 or earlier, visionOS 26.2 or earlier, watchOS 26.2 or earlier; No denial-of-service prevention; Attack vector is network-based (malicious website or injected web content) agent

DeliveryMaliciously crafted web content delivered via URL (website, email link, or web-based messaging) that is processed by WebKit

Public PoCno

Advisoryhttps://support.apple.com/en-us/125892

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.0-8.9) | User interaction required (UI:R) | Reported as exploited in extremely sophisticated targeted attacks against specific individuals on iOS versions before iOS 26 | Vulnerability discovered and reported by Google Threat Analysis Group (Google TAG) | WebKit Bugzilla reference: 302502 | Closely related to CVE-2025-14174 (memory corruption in ANGLE, also actively exploited) | HKCERT risk level: Extremely High Risk

SummaryUse-after-free vulnerability in Apple WebKit that allows remote code execution when processing maliciously crafted web content. Fixed in Safari 26.2, iOS 18.7.3/iPadOS 18.7.3, iOS 26.2/iPadOS 26.2, macOS Tahoe 26.2, macOS Sonoma 14.8.3, macOS Sequoia 15.7.3, tvOS 26.2, visionOS 26.2, and watchOS 26.2. Apple confirmed exploitation in extremely sophisticated targeted attacks against specific individuals on iOS versions before iOS 26. Discovered and reported by Google Threat Analysis Group (Google TAG). A related memory corruption issue (CVE-2025-14174 in ANGLE) was also issued in response to the same attack report.

Tia coverage

First reported2026-09-01

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

packagist-themes-exploit-iphone-visitors-to-steal-messages-passw

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.