Loading story…
Apple disclosed and patched two critical WebKit vulnerabilities, CVE-2025-43529 and CVE-2025-14174, that could allow attackers to execute code via Safari and potentially gain broad access to affected iPhones and iPads, including sensitive data such as passwords and financial information. Reporting describes the issues as zero-click/low-interaction style browser exploitation stemming from memory-handling flaws in WebKit, with claims they were exploited as zero-days in the wild prior to Apple’s fixes.
The fixes are reported as delivered in iOS 26, creating exposure risk for users who have not upgraded and for devices that cannot move beyond older iOS/iPadOS versions; multiple sources cite slow adoption of iOS 26, leaving a large population potentially unpatched. Separate coverage encouraging upgrades to iOS 26 frames security as a primary driver (patching “nasty security bugs”), reinforcing the operational takeaway for enterprises: accelerate iOS 26 rollout where supported, and apply compensating controls (e.g., device refresh planning, stricter web content controls, and MDM-enforced update compliance) for fleets that cannot upgrade.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Apple urged users on supported iPhone and iPad models to install the latest operating system updates to receive fixes for the critical WebKit flaws. The reports noted that devices unable to upgrade to iOS 26 remain exposed to these issues.
Subsequent iOS 26 point releases—26.0.1, 26.1, and 26.2—collectively addressed numerous vulnerabilities beyond the initial iOS 26 release. iOS 26.2 also improved AirDrop security by requiring one-time codes for transfers to non-contacts beyond the previous 10-minute window.
Apple issued iOS 26 security updates that patched CVE-2025-43529 and CVE-2025-14174, two WebKit vulnerabilities described as part of a zero-click/zero-day Safari exploitation chain. Apple said the flaws had been exploited in the wild against targeted individuals on pre-iOS 26 versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released security updates to address an **actively exploited zero-day** tracked as **CVE-2026-20700**, warning it may have been used in an “extremely sophisticated” attack targeting specific individuals on versions of iOS prior to *iOS 26*. The flaw affects **`dyld` (Apple’s dynamic linker)** and can allow **arbitrary code execution** when an attacker already has **memory write** capability; reporting attributes discovery to **Google’s Threat Analysis Group** and notes it may have been used as part of an exploit chain. Apple shipped fixes across its ecosystem, including *iOS 26.3*, *iPadOS 26.3*, *macOS Tahoe 26.3*, *watchOS 26.3*, *tvOS 26.3*, and *visionOS 26.3*. The same reporting indicates Apple also issued patches tied to the broader report for **CVE-2025-14174** (an out-of-bounds memory access issue in Chrome’s **ANGLE** graphics component on Mac) and **CVE-2025-43529** (a **use-after-free** leading to code execution), and commentary from security practitioners emphasized that enterprise risk is driven by **patch deployment speed**—particularly where updates rely on end users rather than enforced device management.
Jun 29, 2026
Apple and Google released emergency security updates after discovering that zero-day vulnerabilities in their software were being actively exploited in highly targeted attacks. The campaign, attributed to nation-state actors and commercial spyware vendors, focused on high-value individuals rather than the general public. Apple addressed two critical WebKit vulnerabilities, CVE-2025-14174 and CVE-2025-43529, which were exploited in sophisticated attacks against iPhones, iPads, and Macs running iOS versions prior to 26. Google also patched a Chrome vulnerability discovered in collaboration with Apple’s security team and Google’s Threat Analysis Group, indicating a coordinated response to a broader espionage campaign. The Apple updates, released as iOS 26.2 and iPadOS 26.2, fixed the WebKit flaws that allowed arbitrary code execution and memory corruption through malicious web content. These vulnerabilities affected iPhone 11 and later models, as well as several iPad variants. In addition to the WebKit issues, Apple resolved over 30 other vulnerabilities across various components, including the Kernel and Screen Time. Both companies withheld detailed technical information, suggesting ongoing investigations into the attacks. The rapid deployment of these patches underscores the severity and sophistication of the threat, with both Apple and Google urging users to update their devices immediately.
Jun 29, 2026
Apple published multiple security release notes and update entries across its platforms, including iOS/iPadOS point releases (e.g., iOS/iPadOS 26.2.1, 18.7.4, 16.7.13, 15.8.6, 12.5.8) and watchOS 26.2.1, with Apple indicating **no published CVE entries** for several of the January 2026 point updates. Apple also refreshed or republished detailed historical security-content pages for older products, including macOS Big Sur 11.7.9 (listing fixes such as **CVE-2023-34425** kernel-privilege arbitrary code execution in Apple Neural Engine, **CVE-2023-32364** sandbox restriction bypass, and other privacy/logic issues), Xcode 14.1 (including multiple *git* issues such as **CVE-2022-29187**, **CVE-2022-39253**, **CVE-2022-39260**, plus an Xcode Server privilege issue **CVE-2022-42797**), and visionOS 2 for Apple Vision Pro (including issues like **CVE-2024-44126** heap corruption from crafted files, **CVE-2024-27876** arbitrary file write via archive unpacking race condition, and additional sandbox/data-access weaknesses). Separately, a vendor blog post warned that **critical WebKit vulnerabilities** could enable remote compromise of iOS devices via a malicious webpage (arbitrary code execution and potential credential/data theft), emphasizing patch latency as a key risk; however, the post does not clearly map its claims to specific Apple CVEs or to the “no published CVE entries” iOS/iPadOS point releases listed on Apple’s security releases page. A Reddit /r/netsec item about a **one-click** vulnerability in *IDIS Cloud Manager (ICM) Viewer* (triggered by clicking an untrusted link) is unrelated to Apple/WebKit and does not align with the Apple security-release content.
Jun 29, 2026