CVE-2026-43704: A use-after-free issue was addressed with improved memory management

Description

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious web extension may be able to cause an unexpected process crash.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

Required

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 33% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

MA

macOS · Apple

before 26.5.2 · source: vendor, NVD

IO

iOS · Apple

before 26.5.2 · source: NVD

SA

Safari · Apple

before 26.5.2 · source: vendor, NVD

IA

iOS and iPadOS · Apple

before 26.5.2 · source: vendor

TV

tvOS · Apple

before 26.6 · source: vendor

VI

visionOS · Apple

before 26.6 · source: vendor

WA

watchOS · Apple

before 26.6 · source: vendor