Apple WebKit memory-handling flaw — remote DoS via crafted web content

CVE-2026-43663 is a memory-handling bug in WebKit disclosed on 2026-06-29 and fixed in *Safari 26.5.2*, *macOS Tahoe 26.5.2*, and the corresponding *iOS/iPadOS 26.5.2* trains. Apple's advisory language — *'addressed with improved memory handling'* — is their standard boilerplate for a bounded memory-safety issue. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H tells the whole story: a remote attacker can serve crafted web content that, when a user renders it, causes an *availability-only* impact — the WebKit content process crashes. There is no C or I impact declared by Apple, which is unusual and load-bearing: this is not an RCE precursor in Apple's own analysis, it is a denial-of-service on the tab/process.

The vendor score of 6.5 MEDIUM is arguably generous. A DoS on a per-tab renderer process, on a client-side browser, on a device the user controls, is not what enterprise defenders spend Tuesday morning on. The realistic worst case is that a user browses a hostile page (or a compromised ad on a legitimate page), the tab crashes, and they hit reload. There is no persistence, no cross-origin data leak, no sandbox escape claimed. Given the DEVCORE, Amy Burnett, and Talence credit list, this looks like a fuzzing-derived crasher rather than a chained exploit primitive.

Sources.

1. Apple — About the security content of Safari 26.5.2
2. Apple — About the security content of macOS Tahoe 26.5.2
3. Apple — About the security content of iOS 26.5.2 and iPadOS 26.5.2
4. WebKitGTK Security Advisory WSA-2026-0003
5. FIRST — EPSS Model
6. CISA Known Exploited Vulnerabilities Catalog
7. MITRE CWE-119
8. Feedly — Latest Apple Vulnerabilities

Run on a target macOS host as any user (no privileges required). Compares the installed Safari and macOS build against the fixed 26.5.2 train. Invoke as ./check-cve-2026-43663.sh. For iOS/iPadOS fleets, query MDM inventory for OSVersion >= 26.5.2 instead.

#!/usr/bin/env bash
# CVE-2026-43663 — WebKit memory-handling DoS
# Fixed in Safari 26.5.2 / macOS Tahoe 26.5.2 / iOS/iPadOS 26.5.2
# Exits: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u

FIXED_MAJOR=26
FIXED_MINOR=5
FIXED_PATCH=2

ver_ge() {
  # $1 >= $2 ?
  local a b
  IFS='.' read -r -a a <<< "$1"
  IFS='.' read -r -a b <<< "$2"
  for i in 0 1 2; do
    local av=${a[$i]:-0} bv=${b[$i]:-0}
    if (( av > bv )); then return 0; fi
    if (( av < bv )); then return 1; fi
  done
  return 0
}

if [[ "$(uname -s)" != "Darwin" ]]; then
  echo "UNKNOWN: not a macOS host — check iOS/iPadOS via MDM" >&2
  exit 2
fi

# macOS product version
OS_VER=$(sw_vers -productVersion 2>/dev/null || echo "")
if [[ -z "$OS_VER" ]]; then
  echo "UNKNOWN: cannot read sw_vers" >&2
  exit 2
fi

# Safari CFBundleShortVersionString
SAFARI_PLIST="/Applications/Safari.app/Contents/Info.plist"
SAFARI_VER=""
if [[ -f "$SAFARI_PLIST" ]]; then
  SAFARI_VER=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$SAFARI_PLIST" 2>/dev/null || echo "")
fi

TARGET="${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH}"

OS_OK=1; SAFARI_OK=1
ver_ge "$OS_VER"     "$TARGET" || OS_OK=0
[[ -n "$SAFARI_VER" ]] && { ver_ge "$SAFARI_VER" "$TARGET" || SAFARI_OK=0; }

echo "macOS:  $OS_VER  (need >= $TARGET)"
echo "Safari: ${SAFARI_VER:-not-installed}  (need >= $TARGET)"

if (( OS_OK == 1 )) && (( SAFARI_OK == 1 )); then
  echo "PATCHED"
  exit 0
fi

echo "VULNERABLE"
exit 1