Apple fixes Safari WebKit use-after-free and 30+ flaws across iOS, iPadOS, and macOS

Apple released security updates for Safari, iOS, iPadOS, and macOS to fix more than 30 vulnerabilities, including the high-severity Safari/WebKit flaw CVE-2026-43715, a remotely exploitable use-after-free bug triggered by maliciously crafted web content. Apple said the issue could lead to memory corruption and addressed it with improved memory management in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2; the flaw carries a CVSS 8.8 rating.

The broader patch set also remediates additional WebKit and kernel vulnerabilities that could cause crashes, sensitive data exposure, sandbox escape, and kernel memory corruption. Apple said none of the flaws were known to be exploited in the wild, but it is accelerating patch delivery because AI-assisted research may shorten the gap between vulnerability discovery and weaponization; several of the WebKit bugs were identified with help from OpenAI Codex Security and researchers using Anthropic Claude.