Apple fixes Safari WebKit use-after-free and 30+ flaws across iOS, iPadOS, and macOS
Apple released security updates for Safari, iOS, iPadOS, and macOS to fix more than 30 vulnerabilities, including the high-severity Safari/WebKit flaw CVE-2026-43715, a remotely exploitable use-after-free bug triggered by maliciously crafted web content. Apple said the issue could lead to memory corruption and addressed it with improved memory management in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2; the flaw carries a CVSS 8.8 rating.
The broader patch set also remediates additional WebKit and kernel vulnerabilities that could cause crashes, sensitive data exposure, sandbox escape, and kernel memory corruption. Apple said none of the flaws were known to be exploited in the wild, but it is accelerating patch delivery because AI-assisted research may shorten the gap between vulnerability discovery and weaponization; several of the WebKit bugs were identified with help from OpenAI Codex Security and researchers using Anthropic Claude.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Apple issues out-of-band iOS and iPadOS update over AI concerns
Apple released an unexpected out-of-band update, iOS 25.6.2, for iOS and iPadOS, citing concern that AI is shortening the time between vulnerability discovery and exploitation. Apple said it had no evidence the flaws fixed in this update were already being exploited.
Apple releases updates fixing 30+ iOS, macOS, and Safari flaws
Apple released security updates for iOS, iPadOS, macOS, and Safari to address more than three dozen vulnerabilities, including multiple WebKit and kernel-related issues. Apple said none of the vulnerabilities fixed in these releases had been reported as exploited in the wild.
Apple fixes Safari use-after-free flaw CVE-2026-43715
Apple fixed CVE-2026-43715, a high-severity use-after-free vulnerability in Safari, with improved memory management. The patch was released in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
6 references tracked. Mallory keeps watching after this page renders.
Update time: Apple releases security patches for iOS, MacOS Tahoe, Safari - Malware News - Malware Analysis, News and Indicators
malware.news
Open sourceApple Fixes WebKit Flaws in iOS and macOS, With Help From AI Tools - Security Affairs
securityaffairs.com
Open sourceApple is speeding up software patching due to AI security concerns - here’s what you need to know | IT Pro
itpro.com
Open sourceApple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs
thehackernews.com
Open sourceCVE-2026-43715 - Apple Safari Use-After-Free
cvefeed.io
Open sourceAbout the security content of Safari 26.5.2 - Apple Support
support.apple.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple Fixes Safari WebKit Flaws and Xcode Root File-Read Vulnerability
Apple released **Safari 26.4** and **Xcode 26.4** security updates to address multiple vulnerabilities affecting macOS systems. The Safari update for **macOS Sonoma** and **macOS Sequoia** fixes seven `CVE`-tracked issues in **WebKit** and **WebKit Sandboxing** that could enable **Content Security Policy** and **Same Origin Policy** bypasses, **cross-site scripting**, process crashes, cross-origin access to script message handlers, improper processing of restricted web content, and user fingerprinting. Apple said the flaws were mitigated through improved state management, input validation, logic checks, memory handling, and authorization controls. The **Xcode 26.4** advisory covers two vulnerabilities on systems running **macOS Tahoe 26.2 and later**. Apple patched an out-of-bounds read in `otool` (`CVE-2026-28890`) that could let an app trigger an unexpected system termination, and a permissions flaw in **Simulator** (`CVE-2026-28889`) that could allow an app to read arbitrary files as **root**. Apple credited external researchers for the findings and made the updates available through the **Mac App Store**, developer download channels, and its security releases pages.
Jun 29, 2026
Apple Fixes Safari WebKit Flaws and Notification Retention Privacy Bug
Apple released **Safari 26.5** for macOS Sonoma and macOS Sequoia to fix multiple vulnerabilities in **WebKit** and **WebRTC** that could be triggered by malicious web content. The flaws could allow **Content Security Policy bypass**, disclosure of sensitive user information, access to sensitive user data, misuse of another website’s download settings through a malicious iframe, and application or process crashes. Apple attributed the issues to validation, access control, UI handling, memory handling, and use-after-free weaknesses, and credited a broad set of external researchers and organizations for the findings. Apple also shipped updates for older devices—**iOS 16.7.16**, **iPadOS 16.7.16**, **iPadOS 17.7.11**, and **iOS/iPadOS 15.8.8**—to address **`CVE-2026-28950`** in Notification Services. The bug could cause notifications marked for deletion to remain on a device because of a logging issue, creating a privacy and data-handling risk; Apple said it resolved the problem through improved data redaction. Canada’s Cyber Centre urged users and administrators to review Apple’s advisories and apply the updates, including upgrading Safari systems to **26.5 or later**.
Jun 29, 2026
Google AI 'Big Sleep' Uncovers Five Critical Safari WebKit Vulnerabilities
Apple released security updates for Safari and its operating systems after Google's AI-powered agent, Big Sleep, discovered five vulnerabilities in the WebKit component of the Safari browser. These flaws, which include buffer overflow, use-after-free, and memory corruption issues, could allow attackers to crash the browser or corrupt memory by processing maliciously crafted web content. The vulnerabilities are tracked as CVE-2025-43429, CVE-2025-43430, CVE-2025-43431, CVE-2025-43433, and CVE-2025-43434, and were addressed through improved memory handling, bounds checking, and state management. Apple's patches were released as part of iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, watchOS 26.1, visionOS 26.1, and Safari 26.1, covering a wide range of Apple devices including iPhones, iPads, Macs, Apple TV, Apple Watch, and Vision Pro. There is no evidence that these vulnerabilities have been exploited in the wild. The discovery highlights the growing role of AI in vulnerability research and the importance of timely patching for all affected Apple products.
Jun 29, 2026