# CVE-2026-43794: Apple WebKit memory corruption in web content processing

Source: https://junglewise.ai/threats/cve-2026-43794-apple-webkit-memory-corruption-in-web-content-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-43794 · Severity: high · CVSS 8.8 · Published 2026-08-17

WebKit, the browser engine used in Safari and other Apple applications, contains a memory corruption vulnerability that can be triggered by viewing maliciously crafted web content. An attacker could exploit this flaw to crash Safari, corrupt system memory, or potentially execute arbitrary code, affecting users across iPhones, iPads, Macs, and other Apple devices.

Technologies: [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados), [Apple macOS Tahoe](https://junglewise.ai/threats/technologies/macos), [Apple Safari](https://junglewise.ai/threats/technologies/safari), [Apple Tvos](https://junglewise.ai/threats/technologies/tvos), [Apple Visionos](https://junglewise.ai/threats/technologies/visionos), [Apple watchOS](https://junglewise.ai/threats/technologies/watchos). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple).

## Quick answers

**Is CVE-2026-43794 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43794 being exploited in the wild.

**How severe is CVE-2026-43794?** High severity, with a CVSS score of 8.8, published 17 August 2026.

**Which products and versions are affected?** Apple iPadOS before 18.7.10 and before 26.6.1; Apple macOS Tahoe before 26.6.2; Apple Safari before 26.6.1; Apple Tvos before 27; and 2 more.

**Is there a fix for CVE-2026-43794?** A patch was published on 2026-08-17: Fixes released in Safari 26.6.1, iOS/iPadOS versions, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43794 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-43794?** Check whether you run Apple iPadOS, Apple macOS Tahoe, Apple Safari or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-43794 is a memory corruption vulnerability in Apple's WebKit engine, addressed through improved memory handling. The vulnerability is triggered when processing maliciously crafted web content and does not require user interaction beyond opening a malicious webpage. The flaw affects WebKit across multiple Apple platforms including Safari, iOS, iPadOS, and macOS. The vulnerability has been patched in Safari 26.6.1, iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27. No known active exploitation in the wild has been reported.

## Affected products

- Apple Safari before 26.6.1
- Apple iOS before 18.7.10 and before 26.6.1
- Apple iPadOS before 18.7.10 and before 26.6.1
- Apple macOS Tahoe before 26.6.2
- Apple tvOS before 27
- Apple visionOS before 27
- Apple watchOS before 27

## Timeline

- 2026-08-17: disclosed: CVE-2026-43794 disclosed and patched
- 2026-08-17: patched: Fixes released in Safari 26.6.1, iOS/iPadOS versions, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27

## References

- [https://support.apple.com/en-us/148281](https://support.apple.com/en-us/148281)
- [https://support.apple.com/en-us/148282](https://support.apple.com/en-us/148282)

## Related threats

- [Apple Bluetooth use-after-free vulnerability](https://junglewise.ai/threats/cve-2026-113970-a-use-after-free-issue-was-addressed-with-improved-memory)
- [Apple iOS, iPadOS, macOS, and related platforms rate limit bypass in AirPlay pairing](https://junglewise.ai/threats/cve-2026-113969-a-logic-issue-was-addressed-with-improved-state-management-this)
- [Apple iOS and iPadOS Bluetooth pairing code rate limit bypass](https://junglewise.ai/threats/cve-2026-113968-a-logic-issue-was-addressed-with-improved-state-management-this)
- [Apple iOS/iPadOS Bluetooth pairing bypass](https://junglewise.ai/threats/cve-2026-113965-this-issue-was-addressed-with-improved-checks-this-issue-is)
- [Apple iOS and iPadOS Bluetooth pairing rate limit bypass in CoreUtils](https://junglewise.ai/threats/cve-2026-113964-a-logic-issue-was-addressed-with-improved-state-management-this)