Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild

"Apple on Friday released security updates for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and its Safari web browser to address two security flaws that it said have been exploited in the wild, one of which is the same flaw that was patched by Google in Chrome earlier this week. The vulnerabilities are listed below - CVE-2025-43529 (CVSS score: N/A) - A use-after-free vulnerability in WebKit that may lead to arbitrary code execution when processing maliciously crafted web content CVE-2025-14174 (CVSS score: 8.8) - A memory corruption issue in WebKit that may lead to memory corruption when processing maliciously crafted web content"

"Apple said it's aware that the shortcomings "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26." It's worth noting that CVE-2025-14174 is the same vulnerability that Google issued patches for in its Chrome browser on December 10, 2025. It's been described by the tech giant as an out-of-bounds memory access in the company's open-source Almost Native Graphics Layer Engine (ANGLE) library, specifically in its Metal renderer. Apple Security Engineering and Architecture (SEAR) and Google Threat Analysis Group (TAG) have been credited with discovering and reporting the flaw, while Apple credited TAG with finding CVE-2025-43529."

Apple issued security updates for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari to remediate two WebKit vulnerabilities: CVE-2025-43529 (use-after-free) and CVE-2025-14174 (memory corruption). Apple acknowledged possible exploitation in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 26. CVE-2025-14174 corresponds to a Chrome patch and is described as an out-of-bounds memory access in the ANGLE library's Metal renderer. Apple SEAR and Google TAG are credited with discovery and reporting; Apple credited TAG with finding CVE-2025-43529. The flaws likely enabled targeted mercenary spyware because WebKit is used by all third-party iOS browsers. The fixes appear in iOS 26.2 and iPadOS 26.2 for supported devices.

Read at The Hacker News