Apple fixed two WebKit flaws possibly exploited against targeted users

What happened

Apple fixed two flaws in WebKit, the engine behind Safari, in iOS and iPadOS 26.2. Apple said both may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26.

Both flaws are triggered by maliciously crafted web content.

What was found

CVE-2025-43529 is a use-after-free that may lead to arbitrary code execution; CVE-2025-14174 is a memory corruption issue. Google's Threat Analysis Group found the first, and Apple and Google found the second together. Both later appeared in the DarkSword exploit chain.

Data at risk

• Not disclosed by Apple

What you should do

1. 1Update to iOS or iPadOS 26.2 or later.
2. 2Better still, update straight to the latest version.