Google AI 'Big Sleep' Uncovers Five Critical Safari WebKit Vulnerabilities
Apple released security updates for Safari and its operating systems after Google's AI-powered agent, Big Sleep, discovered five vulnerabilities in the WebKit component of the Safari browser. These flaws, which include buffer overflow, use-after-free, and memory corruption issues, could allow attackers to crash the browser or corrupt memory by processing maliciously crafted web content. The vulnerabilities are tracked as CVE-2025-43429, CVE-2025-43430, CVE-2025-43431, CVE-2025-43433, and CVE-2025-43434, and were addressed through improved memory handling, bounds checking, and state management.
Apple's patches were released as part of iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, watchOS 26.1, visionOS 26.1, and Safari 26.1, covering a wide range of Apple devices including iPhones, iPads, Macs, Apple TV, Apple Watch, and Vision Pro. There is no evidence that these vulnerabilities have been exploited in the wild. The discovery highlights the growing role of AI in vulnerability research and the importance of timely patching for all affected Apple products.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-43431 is publicly disclosed as a high-severity Safari flaw
CVE-2025-43431 was publicly published as a high-severity memory corruption vulnerability with a CVSS score of 8.8, affecting Safari and multiple Apple operating systems. Public proof-of-concept exploit code was also noted as being available on GitHub.
Apple patches CVE-2025-43431 and related Safari/WebKit flaws
Apple released fixes for CVE-2025-43431 and the other newly disclosed Safari/WebKit vulnerabilities in Safari and version 26.1 of affected platforms including iOS, iPadOS, watchOS, tvOS, and visionOS. The company said the issue was addressed through improved memory handling and advised users to update.
Google Big Sleep discovers five Safari WebKit vulnerabilities
Google's AI-powered security agent Big Sleep identified five previously unknown vulnerabilities in Apple's Safari/WebKit. The flaws included high-severity memory corruption issues that could be triggered by maliciously crafted web content.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
4 references tracked. Mallory keeps watching after this page renders.
Almost half a dozen WebKit bugs discovered
scworld.com
Open sourceCVE-2025-43431 - Safari Memory Corruption Vulnerability
cvefeed.io
Open sourceGoogle's AI 'Big Sleep' Finds 5 New Vulnerabilities in Apple's Safari WebKit
thehackernews.com
Open sourceGoogle Big Sleep found five vulnerabilities in Safari
securityaffairs.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple fixes Safari WebKit use-after-free and 30+ flaws across iOS, iPadOS, and macOS
Apple released security updates for **Safari, iOS, iPadOS, and macOS** to fix more than 30 vulnerabilities, including the high-severity Safari/WebKit flaw **`CVE-2026-43715`**, a remotely exploitable use-after-free bug triggered by maliciously crafted web content. Apple said the issue could lead to memory corruption and addressed it with improved memory management in **Safari 26.5.2**, **iOS 26.5.2**, **iPadOS 26.5.2**, and **macOS Tahoe 26.5.2**; the flaw carries a **CVSS 8.8** rating. The broader patch set also remediates additional WebKit and kernel vulnerabilities that could cause crashes, sensitive data exposure, sandbox escape, and kernel memory corruption. Apple said none of the flaws were known to be exploited in the wild, but it is accelerating patch delivery because AI-assisted research may shorten the gap between vulnerability discovery and weaponization; several of the WebKit bugs were identified with help from **OpenAI Codex Security** and researchers using **Anthropic Claude**.
Jun 30, 2026
Apple Releases Security Updates Addressing Over 100 Vulnerabilities Across Multiple Platforms
Apple released a comprehensive set of security updates for its major operating systems and applications, including iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, tvOS 26.1, watchOS 26.1, visionOS 26.1, Safari 26.1, and Xcode 26.1. The updates address 110 vulnerabilities, several of which involve memory corruption issues in components such as ImageIO, FontParser, and WebKit, potentially allowing remote code execution. Other vulnerabilities could allow unauthorized access to sensitive user data through components like Spotlight, CoreMedia, MallocStackLogging, Admin Framework, sudo, Security, SoftwareUpdate, and AppleMobile. None of the vulnerabilities were reported as actively exploited at the time of release, and Apple provided limited technical details in its advisories. Security authorities, including the Canadian Centre for Cyber Security, have urged users and administrators to promptly apply these updates to mitigate potential risks. The updates are considered routine but critical, given the breadth of affected products and the potential impact of the vulnerabilities. Users are advised to review Apple's official security update documentation and ensure all devices are updated to the latest versions to maintain security and privacy protections.
Jun 29, 2026
Apple Fixes Broad Set of iOS, macOS, and visionOS Vulnerabilities
Apple released a wide-ranging set of security updates across **iOS**, **iPadOS**, **macOS Tahoe**, **watchOS**, **tvOS**, **visionOS**, **Safari**, and **Xcode**, addressing more than 85 vulnerabilities across core components including the kernel, WebKit, AirPlay, Keychain, and open-source libraries. The updates fix issues that could enable traffic interception, kernel state disclosure, user fingerprinting, installed-app enumeration, Mail privacy bypasses, exposure of deleted Notes content, and crashes from out-of-bounds writes. Apple said it had no reports of in-the-wild exploitation for the vulnerabilities listed in the release notes, but urged users to update, with particular importance for older devices and managed macOS environments. Among the patched flaws is **`CVE-2024-27828`**, a high-severity memory-handling bug in **IOSurfaceRoot** that could let a local app trigger a kernel panic or execute arbitrary code with kernel privileges. STAR Labs said the issue stemmed from a reference count leak in `IOSurfaceRootUserClient::s_create_shared_event`, where repeated calls with crafted input could corrupt memory handling; the flaw affected iOS and iPadOS before 17.5, tvOS before 17.5, watchOS before 10.5, and visionOS before 1.2. Apple addressed the bug through improved memory handling, adding it to a broader pattern of fixes spanning both current and legacy Apple platforms.
Jun 30, 2026