Product:
iOS, iPadOS, macOS, tvOS, visionOS, watchOS
Summary
A validation issue was addressed with improved logic. This issue may allow processing of maliciously crafted web content, which could prevent Content Security Policy from being enforced. The issue has been fixed in several versions of Apple’s operating systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-43660 |
Exploitation
An attacker can exploit this vulnerability by crafting malicious web content that, when processed by the affected systems, bypasses the Content Security Policy. This could lead to unauthorized access to sensitive information or manipulation of web content without proper security measures in place.
Affected Products
- iOS 18.7.9 and later: Addresses the validation issue with improved logic.
- iPadOS 18.7.9 and later: Fixes the vulnerability affecting web content processing.
- macOS Tahoe 26.5 and later: Resolves the issue related to Content Security Policy enforcement.
- tvOS 26.5 and later: Mitigates the risk associated with the validation issue.
- visionOS 26.5 and later: Addresses the vulnerability in web content handling.
- watchOS 26.5 and later: Fixes the issue impacting security policies.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of the affected operating systems. Regularly applying security updates is crucial to protect against potential exploits and ensure that security policies are enforced correctly.