Apple Patches More Zero-Days Used in 'Sophisticated' Attack

Apple has issued patches for two WebKit zero-days disclosed this month, with one sharing a CVE with a Google vulnerability reported last week. The flaws are CVE-2025-43529, a use-after-free that could lead to arbitrary code execution, and CVE-2025-14174, a memory corruption issue corrected by improved validation and memory management.

Both were discovered in collaboration with Google’s Threat Analysis Group and were patched across iOS 26.2, iPadOS 26.2, iOS 18.7.3, iPadOS 18.7.3 and macOS Tahoe 26.2 on 12 December 2025. Patch notes note that Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS prior to iOS 26.

Google’s Chrome team later updated patch notes to reveal that the related vulnerability was an out-of-bounds memory access in ANGLE, found by Apple’s SEAR team and Google TAG on 5 December. Dark Reading contacted Apple and Google for comment but neither had responded at press time.