CVE-2026-43794

CVE-2026-43794 is a memory corruption flaw (CWE-119) in Apple's handling of web content, addressed with improved memory handling in the September 2026 Apple security updates. It is triggered when a user processes maliciously crafted web content — for example, by loading an attacker-controlled page — which the CVSS vector confirms requires user interaction (UI:R) but no privileges. Successful exploitation could compromise confidentiality, integrity, and availability (all rated High), consistent with a memory corruption bug that may permit arbitrary code execution or crashes on the affected device. Anyone using Safari or the affected Apple operating systems on unpatched versions is exposed, which spans essentially the entire Apple user base. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days, so no exploitation is known at this time.

What to do: Update Safari to 26.6.1, iOS/iPadOS to 18.7.10 (older devices) or 26.6.1 (current generation), macOS Tahoe to 26.6.2, and tvOS, visionOS, and watchOS to version 27 as soon as possible. Because the attack vector is web content, prioritize patches for user-facing endpoints such as managed Macs and iPhones. Check MDM or fleet inventory for devices stuck on older, unsupported branches and consider limiting their browsing to non-WebKit-based browsers as an interim mitigation.