CVE-2026-43725

Normally, Safari and Apple’s web features keep risky web activity “inside a fence” so it can’t do much damage. This bug could let a malicious website slip past that fence to handle restricted web content. Think of it like a building’s restricted hallway getting a temporary door that shouldn’t open—so updates are important to close it.

This matters if your business uses Apple devices that browse the web with Safari (including iPhone, iPad, and Mac). The issue is triggered by a malicious website, with no authentication required, but user interaction (visiting the site) is required. It is only a risk when you (or someone on the device) opens the attacker-controlled website in the affected Safari/web browsing context.

This should be treated as an update priority because a malicious website can trigger the sandbox-bypass behavior, and the fix is already available for Safari/iOS/iPadOS/macOS 26.5.2. There’s no confirmed CISA KEV listing or clear dated press exploitation claim in the findings, and no public exploit code was found—however, the vulnerability involves web browsing, which is common in everyday business use.