WebKitGTK Use-After-Free Flaw Exposes Process Memory Across Apple and Red Hat Systems

Apple and Red Hat disclosed CVE-2026-43740, a moderate-severity use-after-free vulnerability in WebKit-derived web content processing that can let maliciously crafted pages disclose process memory. The flaw stems from improper memory handling, is mapped to CWE-416, and requires user interaction but no privileges, with Red Hat assigning a CVSS v3.1 score of 6.5 and noting a network attack vector and low attack complexity.

Apple said the issue was fixed in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Red Hat said affected WebKitGTK packages were addressed through multiple advisories for Red Hat Enterprise Linux 7, 8, and 9 product streams, while RHEL 6 packages are outside support scope and should be assumed affected.