CVE-2026-43701 - Vulnerability Details

- webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox

Description

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to process restricted web content outside the sandbox.

Published: 2026-06-29

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A malicious website can serve content that bypasses the WebKitGTK sandbox, allowing untrusted code or data to be processed by a privileged web-kit process. This Improper Access Control flaw (CWE‑284) enables a sandbox escape, potentially leaking sandboxed resources or executing code outside the intended isolation. The patching of this issue is available in Safari 26.5.2, iOS 18.7.10, iPadOS 18.7.10, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Until those updates are applied, the vulnerability remains exploitable.

Affected Systems

Affected are Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Versions older than Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6 are vulnerable. The fixes are applied in those releases and later.

Risk and Exploitability

The flaw can be triggered by a user visiting a specially crafted web page; no additional privileges are required. Because the attack allows sandbox escape, it can affect the entire device. The EPSS score is less than 1%, the vulnerability is not listed in KEV, and the CVSS score of 7.1 indicates high severity. Attack likely proceeds over standard web traffic, such as HTTPS or HTTP, from an untrusted site.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

Safari

affected

Version	Status	Constraints
`0`	affected	< 26.5.2

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.10
`0`	affected	< 26.5.2

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 26.5.2

Apple

tvOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Configuration 1 [-]

OR	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::

No data.

Vendor Product Confidence Versions

Apple

Ios And Ipados

100%

Version	Status	Scheme	Platform
`[0,26.5.2)`	affected	semver	—

Apple

Macos

100%

Version	Status	Scheme	Platform
`[0,26.5.2)`	affected	semver	—

Apple

Safari

100%

Version	Status	Scheme	Platform
`[0,26.5.2)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update all affected Apple software, including Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, to the corresponding bug‑fixed releases (Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6).
If an update cannot be applied immediately, block or mitigate the processing of untrusted content by disabling JavaScript in the browser or using enterprise content filtering policies to block malicious or suspicious sites.
Implement security controls such as enabling System Integrity Protection and limiting application permissions to reduce the impact if sandbox escape occurs. Monitor for anomalies like unexpected local file access or privilege escalation.

Generated by OpenCVE AI on August 17, 2026 at 22:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6398-1	webkit2gtk security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00551.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://bugs.webkit.org/show_bug.cgi?id=315004
https://nvd.nist.gov/vuln/detail/CVE-2026-43701
https://support.apple.com/en-us/127594
https://support.apple.com/en-us/127595
https://support.apple.com/en-us/127685
https://support.apple.com/en-us/128068
https://support.apple.com/en-us/128069
https://support.apple.com/en-us/128070
https://support.apple.com/en-us/148287
https://webkitgtk.org/security/WSA-2026-0004.html
https://www.cve.org/CVERecord?id=CVE-2026-43701

History

Mon, 17 Aug 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to process restricted web content outside the sandbox.	The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to process restricted web content outside the sandbox.
References		https://support.apple.com/en-us/148287

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious website may be able to process restricted web content outside the sandbox.	The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to process restricted web content outside the sandbox.
References		https://support.apple.com/en-us/128068 https://support.apple.com/en-us/128069 https://support.apple.com/en-us/128070

Fri, 17 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Title	Safari and iOS Sandbox Escape via Malicious Web Content	webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox
References		https://bugs.webkit.org/show_bug.cgi?id=315004 https://nvd.nist.gov/vuln/detail/CVE-2026-43701 https://webkitgtk.org/security/WSA-2026-0004.html https://www.cve.org/CVERecord?id=CVE-2026-43701
Metrics	threat_severity `None`	threat_severity `Important`

Tue, 30 Jun 2026 21:45:00 +0000

Type	Values Removed	Values Added
Title		Safari and iOS Sandbox Escape via Malicious Web Content

Tue, 30 Jun 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 30 Jun 2026 16:45:00 +0000

Type	Values Removed	Values Added
Title	Safari, iOS, iPadOS, macOS Sandbox Escape via Malicious Web Content

Tue, 30 Jun 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 30 Jun 2026 03:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple safari
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple safari

Mon, 29 Jun 2026 21:45:00 +0000

Type	Values Removed	Values Added
Title		Safari, iOS, iPadOS, macOS Sandbox Escape via Malicious Web Content
Weaknesses		CWE-284

Mon, 29 Jun 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious website may be able to process restricted web content outside the sandbox.
References		https://support.apple.com/en-us/127594 https://support.apple.com/en-us/127595 https://support.apple.com/en-us/127685

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-06-29T19:43:06.947Z

Updated: 2026-08-17T21:31:09.323Z

Reserved: 2026-05-01T22:46:21.643Z

Link: CVE-2026-43701

Vulnrichment

Updated: 2026-06-30T13:08:06.383Z

NVD

Status : Modified

Published: 2026-06-29T20:17:35.173

Modified: 2026-08-17T22:17:07.150

Link: CVE-2026-43701

Redhat

Severity : Important

Publid Date: 2026-07-10T00:00:00Z

Links: CVE-2026-43701 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-17T22:45:04Z

Weaknesses

CWE-284
Improper Access Control

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object