The issue was addressed with improved memory handling

CVE-2026-43663 is a memory-handling bug in WebKit disclosed on 2026-06-29 and fixed in *Safari 26.5.2*, *macOS Tahoe 26.5.2*, and the corresponding *iOS/iPadOS 26.5.2* trains. Apple's advisory language — *'addressed with improved memory handling'* — is their standard boilerplate for a bounded memory-safety issue. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H tells the whole story: a remote attacker can serve crafted web content that, when a user renders it, causes an *availability-only* impact — the WebKit content process crashes. There is no C or I impact declared by Apple, which is unusual and load-bearing: this is not an RCE precursor in Apple's own analysis, it is a denial-of-service on the tab/process.

The vendor score of 6.5 MEDIUM is arguably generous. A DoS on a per-tab renderer process, on a client-side browser, on a device the user controls, is not what enterprise defenders spend Tuesday morning on. The realistic worst case is that a user browses a hostile page (or a compromised ad on a legitimate page), the tab crashes, and they hit reload. There is no persistence, no cross-origin data leak, no sandbox escape claimed. Given the DEVCORE, Amy Burnett, and Talence credit list, this looks like a fuzzing-derived crasher rather than a chained exploit primitive.

Why this verdict

• Availability-only impact: C:N/I:N/A:H means the vendor sees no data-disclosure or integrity primitive here. Blast radius is a crashed renderer, not code execution.
• User interaction required: UI:R means the victim must actively browse to attacker-controlled content — no drive-by from a passive port scan, no worming.
• Role multiplier: WebKit ships on macOS/iOS clients and embedded WKWebView. There is *no* canonical high-value role for a browser DoS — it does not run on domain controllers, hypervisors, PAM, backup, or CI. Even in embedded kiosk / signage roles the outcome is a single-view crash, not fleet compromise. Floor is LOW.
• No exploitation signal: EPSS 0.00194, no KEV, no public PoC, Apple did *not* flag this as exploited (they do flag those explicitly — see the December 2025 WebKit zero-days).
• Process isolation contains it: WebKit's WebContent process is sandboxed and one-tab-per-process on modern Safari; a crash does not take the whole browser, let alone the OS.

Why not higher?

MEDIUM would imply meaningful defender workload beyond the standard OS-update ring. There is no confidentiality or integrity primitive here per the vendor vector, no active exploitation, no KEV, and no PoC. Fleet-wide impact is bounded by process isolation and user interaction.

Why not lower?

IGNORE would be wrong because it *is* remotely reachable (AV:N, PR:N, AC:L) and does affect availability of a user-facing app. Apple advisory language occasionally undersells memory-safety bugs that later prove chainable — the patch is trivially shipped via existing update infrastructure, so there is no reason to skip it.

1. Ship the OS/browser update through your normal ring — macOS 26.5.2 / iOS 26.5.2 / iPadOS 26.5.2 / Safari 26.5.2 carry the fix. There is no mitigation SLA at LOW — roll it in the standard patch train, target completion within the noisgate remediation SLA of 365 days, though in practice Apple auto-update will finish this in weeks.
2. Confirm MDM enforcement of AutomaticSoftwareUpdate and SafariAutoUpdate — Jamf / Intune / Kandji policy audit: verify managed Macs and iOS devices are not deferring OS updates beyond 30 days. This is the durable control that closes this CVE and the next fifty WebKit CVEs.
3. Add WebContent crash telemetry to EDR baselines — Forward /Library/Logs/DiagnosticReports/*WebContent* and iOS crash logs to your SIEM. Not for this CVE specifically — for the class. A fleet-wide spike is a cheap hunting signal for hostile-web-content campaigns.
4. Ensure DNS/URL filtering (Umbrella, Zscaler, NetSkope, or MDM Content Filter) is enforcing known-bad domain lists — Removes the delivery vector for opportunistic exploitation, which matters more for the *next* WebKit RCE than this DoS.

Run on a target macOS host as any user (no privileges required). Compares the installed Safari and macOS build against the fixed 26.5.2 train. Invoke as ./check-cve-2026-43663.sh. For iOS/iPadOS fleets, query MDM inventory for OSVersion >= 26.5.2 instead.

#!/usr/bin/env bash
# CVE-2026-43663 — WebKit memory-handling DoS
# Fixed in Safari 26.5.2 / macOS Tahoe 26.5.2 / iOS/iPadOS 26.5.2
# Exits: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u

FIXED_MAJOR=26
FIXED_MINOR=5
FIXED_PATCH=2

ver_ge() {
  # $1 >= $2 ?
  local a b
  IFS='.' read -r -a a <<< "$1"
  IFS='.' read -r -a b <<< "$2"
  for i in 0 1 2; do
    local av=${a[$i]:-0} bv=${b[$i]:-0}
    if (( av > bv )); then return 0; fi
    if (( av < bv )); then return 1; fi
  done
  return 0
}

if [[ "$(uname -s)" != "Darwin" ]]; then
  echo "UNKNOWN: not a macOS host — check iOS/iPadOS via MDM" >&2
  exit 2
fi

# macOS product version
OS_VER=$(sw_vers -productVersion 2>/dev/null || echo "")
if [[ -z "$OS_VER" ]]; then
  echo "UNKNOWN: cannot read sw_vers" >&2
  exit 2
fi

# Safari CFBundleShortVersionString
SAFARI_PLIST="/Applications/Safari.app/Contents/Info.plist"
SAFARI_VER=""
if [[ -f "$SAFARI_PLIST" ]]; then
  SAFARI_VER=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$SAFARI_PLIST" 2>/dev/null || echo "")
fi

TARGET="${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH}"

OS_OK=1; SAFARI_OK=1
ver_ge "$OS_VER"     "$TARGET" || OS_OK=0
[[ -n "$SAFARI_VER" ]] && { ver_ge "$SAFARI_VER" "$TARGET" || SAFARI_OK=0; }

echo "macOS:  $OS_VER  (need >= $TARGET)"
echo "Safari: ${SAFARI_VER:-not-installed}  (need >= $TARGET)"

if (( OS_OK == 1 )) && (( SAFARI_OK == 1 )); then
  echo "PATCHED"
  exit 0
fi

echo "VULNERABLE"
exit 1

Sources

1. Apple — About the security content of Safari 26.5.2
2. Apple — About the security content of macOS Tahoe 26.5.2
3. Apple — About the security content of iOS 26.5.2 and iPadOS 26.5.2
4. WebKitGTK Security Advisory WSA-2026-0003
5. FIRST — EPSS Model
6. CISA Known Exploited Vulnerabilities Catalog
7. MITRE CWE-119
8. Feedly — Latest Apple Vulnerabilities