CVE-2026-43715: WebKit Use-After-Free in Safari and iOS

CVE-2026-43715 is a use-after-free vulnerability in the WebKit rendering engine, used by Safari, iOS, iPadOS, macOS Tahoe, and other Apple systems. The flaw allows malicious web content to cause memory corruption in the browser, potentially leading to arbitrary code execution or data theft. It affects ecosystems widely deployed in corporate environments.

The vulnerability received a CVSS score of 8.8 in the high range. Apple released patches on June 29, 2026 for Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, iOS 26.7, iPadOS 26.7, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Significant signal: on November 1, 2026, exploit research for a jailbreak (Switch 2) using the CSSFontFace UAF in CVE-2026-43715 was published on GitHub, confirming practical exploitability of the flaw.

IT administrators and CISOs must prioritize updating all corporate Apple devices to patched versions. For iOS/iPadOS, enforce updates to versions 26.5.2 or 26.7. For macOS, upgrade to Tahoe 26.5.2. Review Safari logs for anomalous requests to compromised sites. Implement network protections to block suspicious web content loads or requests from known malicious domains.