Apple has released a broad set of security updates for its operating systems and Safari browser, addressing two serious WebKit vulnerabilities that Apple confirms have been exploited in the wild.
Vulnerabilities addressed
- CVE-2025-43529 – Use-after-free vulnerability in WebKit
➜ May allow arbitrary code execution via malicious web content - CVE-2025-14174 (CVSS 8.8) – Memory corruption issue in WebKit
➜ Caused by out-of-bounds memory access
Notably, CVE-2025-14174 is the same flaw Google patched in Chrome on December 10, 2025, affecting the ANGLE graphics library (Metal renderer).
Apple warns these issues “may have been exploited in an extremely sophisticated attack against specific targeted individuals”, suggesting use in high-end mercenary spyware campaigns.
Why this matters
- WebKit powers Safari and all third-party browsers on iOS & iPadOS
- Vulnerabilities affect Chrome, Edge, Firefox, and others on Apple platforms
- Discovered by Apple SEAR and Google Threat Analysis Group (TAG)
- Indicates cross-vendor, weaponized exploitation
Affected platforms (patched versions)
✔ iOS / iPadOS 26.2 & 18.7.3
✔ macOS Tahoe 26.2
✔ Safari 26.2 (Sonoma & Sequoia)
✔ tvOS 26.2
✔ watchOS 26.2
✔ visionOS 26.2
Bigger picture
With these fixes, Apple has now patched 9 zero-day vulnerabilities exploited in 2025, underscoring the growing role of browser and rendering engines as initial access vectors.
Recommended action
✔ Update all Apple devices immediately
✔ Ensure Safari is fully patched
✔ Treat delayed updates as a real security risk, especially for high-value users
