CVE-2026-437257.1High

CVE-2026-43725: Apple Safari vulnerability

Apple · Safari

Vendor fix available · Affected: Apple Safari · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not establishedNothing in the sources we check

0.9%probability of exploitation in the next 30 days

60th percentile

050100

Higher than 60% of scored CVEs

7.1HighCVSS

LowMediumHighCrit.

DescriptionNVD

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to process restricted web content outside the sandbox.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Input Validation · Input Validation and Logic
Vendor: Apple
Published: June 2026
Band: Unlikely (under 1%), June 2026

Coverage1 article · 1 outlet

First in our coverage: thezdi.com, 1 Jul.

1 Jul 16:02
Apple patches 37 WebKit kernel flaws, including sandbox escapes
thezdi.com · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.