Urgent: Apple Patches Two Critical WebKit Zero-Days Under Active Exploitation Against High-Risk Targets

Apple has issued an urgent security intervention for iPhone and iPad users, releasing patches for two critical WebKit zero-days that are currently being exploited in the wild against high-risk targets, according to Apple’s advisory. The vulnerabilities are tracked as CVE-2025-43529 and CVE-2025-14174 and allow attackers to execute malicious code by simply tricking a victim into loading a web page.

Both flaws reside in WebKit, affecting a broad range of modern Apple mobile hardware, with updates advised to iOS 26 or later versions. The advisory notes that the attacks are “extremely sophisticated” and targeted at specific individuals, a language typically associated with state-sponsored spyware campaigns. CVE-2025-43529 is a use-after-free issue discovered by the Google Threat Analysis Group, while CVE-2025-14174 involves memory corruption patched through improved input validation.

Users are urged to update promptly; affected devices include iPhone 11 and later, iPad Pro, iPad Air, iPad, and iPad mini generations listed in the article.