CVE-2026-43731
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A use-after-free issue was addressed with improved memory management. Processing maliciously crafted web content may lead to memory corruption.
Risk Assessment
Memory corruption may lead to unexpected browser behavior and, in extreme cases, arbitrary code execution.
Recommendation
Update Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS to the versions mentioned in the description.
Other vulnerabilities in Apple Safari
See all- CVE-2015-5780High
The Safari Extensions implementation in Apple Safari before version 9 does not require user confirmation before replacing an installed extension, which may lead to unspecified impacts and attack vectors.
- CVE-2014-1303High
A heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism.
- CVE-2014-1300High
An unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors.
- CVE-2026-43670High
A Content Security Policy bypass was addressed in AudioWorklet contexts in Safari and Apple operating systems. Processing maliciously crafted web content may bypass CSP.
- CVE-2026-43794High
A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption.
- CVE-2026-64757High
A memory corruption issue was addressed with improved state management. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-64719High
An out-of-bounds access issue was addressed with improved bounds checking. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- CVE-2026-43735High
The issue was addressed with improved checks. A malicious website may exfiltrate data cross-origin.
- CVE-2026-43725High
The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to process restricted web content outside the sandbox.
- CVE-2026-28958Medium
A vulnerability in Safari and Apple systems, fixed with improved data protection. An app may be able to access sensitive user data.
Original NVD description (English source)
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption.