CVE-2026-43715

This CVE presents a use-after-free in WebKit's rendering engine with a CVSS 8.8 score, but the fixed versions listed—Safari 26.5.2 and iOS 26—do not correspond to any currently released Apple software. Current stable releases sit at Safari 18.x and iOS 17-18. This creates a fundamental analytical problem: you cannot assess your actual exposure because the vulnerable versions may not exist in your deployment yet, or the disclosure may be forward-dated or hypothetical. The use-after-free class itself is well-understood and consistently exploitable. The 'processing maliciously crafted web content' phrasing indicates a drive-by model requiring no user interaction beyond visiting a page. However, the cross-platform scope matters more than usual: WebKit powers Safari across macOS, iOS, iPadOS, watchOS, tvOS, and visionOS. A single renderer vulnerability creates simultaneous attack surface across your entire Apple device ecosystem—a horizontal blast radius that invalidates single-platform threat modeling. The sparse disclosure language ('improved memory management') is typical of Apple's security advisories but creates a secondary problem: you cannot determine which WebKit subsystem contained the UAF. Historical analysis shows that vocabulary correlates with subsystem—JavaScriptCore JIT issues tend toward vague phrasing, while renderer-layer bugs receive more specific language. This CVE gives you nothing to work with, so assume the worst case: JavaScriptCore or JIT-adjacent code where exploitation chains through sandbox escape. For defenders, the version numbering destroys conventional temporal analysis. You cannot measure Apple's patch cadence, calculate EPSS relevance, or anchor the vulnerability lifecycle to a real timeline. The most useful analytical frame is patch-diff lifecycle: if this CVE is genuine, expect the commit that closed this UAF to appear in Apple's WebKit repository shortly before this disclosure date. Track whether that commit affects all six platforms or lands in platform-specific branches—this tells you whether the fix propagated uniformly. The compounding risk model here is inverted: instead of 'disclosed but unpatched,' you're potentially dealing with 'patched but not yet protecting users' if the fix shipped before the CVE publication. During any coordination window, reverse-engineers could analyze the patch to identify the pre-fix vulnerability in older branches still running on devices that haven't updated. Your exposure window may have already opened and closed before you learned the CVE existed.

Reviewed through automated stages and approved by a human before publication.