Apple has rolled out emergency patches across its ecosystem to fix two WebKit zero-day vulnerabilities, CVE-2025-43529 and CVE-2025-14174, that were already being exploited in highly targeted attacks against iPhone and other Apple users.
Two WebKit zero-days under active exploit
Apple’s latest security updates for iOS 26.2 and iPadOS 26.2 address a pair of WebKit flaws that allow attackers to compromise devices using nothing more than malicious web content.Because all iOS and iPadOS browsers are forced to use WebKit, the attack surface spans Safari, Chrome, Edge, Firefox, in-app browsers, and any app embedding web views.Apple confirms both issues were leveraged in “extremely sophisticated” targeted campaigns against specific individuals on versions prior to iOS 26.
The vulnerabilities are tracked as:
- CVE-2025-43529: A use-after-free bug in WebKit that enables arbitrary code execution when a user loads crafted web content.
- CVE-2025-14174: A memory corruption/out-of-bounds issue tied to the ANGLE graphics layer in WebKit’s rendering pipeline, also exploitable via malicious web content.
How the exploits work in practice
At a high level, CVE-2025-43529 lets attackers abuse freed memory structures in WebKit to execute their own code inside the browser process, which can then be chained with other bugs to escape sandboxes or gain higher privileges.CVE-2025-14174 corrupts memory in the ANGLE graphics subsystem, a classic building block for exploit chains that bypass modern mitigations like ASLR and pointer authentication. Security researchers note that one of the flaws overlaps with a Chrome zero-day patched days earlier, suggesting coordinated browser-engine targeting across vendors.
Reporting credits go to Google’s Threat Analysis Group (TAG) and Apple’s own Security Engineering and Architecture (SEAR) team, which strongly points to detection in the context of mercenary spyware or nation-state surveillance operations.Public write-ups emphasize that attacks appear highly targeted rather than mass exploitation, but once techniques are known, broader campaigns often follow.
Affected platforms and patch coverage
Although headlines focus on iPhones, the impact is much wider because WebKit underpins web content across Apple platforms. The two zero-days are addressed in coordinated updates for:
- iOS 26.2 and iPadOS 26.2.
- macOS releases, with additional standalone Safari updates for recent macOS versions such as Sonoma and Sequoia.
- watchOS, tvOS, visionOS, and Safari on macOS.
Some advisories tally these patches as bringing Apple’s 2025 in-the-wild zero-day count to roughly seven to nine vulnerabilities across WebKit and other components, underlining sustained pressure on Apple’s ecosystem.
Why this matters for enterprises
For enterprises, the significance goes far beyond consumer iPhones: WebKit is embedded in corporate-managed iOS browsers, internal line-of-business apps, and SSO or MDM portals that rely on in-app web views.Any high-value user—executives, admins, legal, M&A, or journalists—who has not yet updated remains exposed to quiet drive‑by compromise via targeted URLs, malicious ads, or phishing links that simply need to be rendered by WebKit.
These exploits align with typical mobile spyware tradecraft: a WebKit RCE paired with a privilege‑escalation or sandbox‑escape chain to deploy persistent implants and exfiltrate messages, credentials, and device telemetry. Given the overlap with Chrome’s ANGLE exploitation, defenders should assume sophisticated adversaries are investing in cross‑browser exploit reuse and supply-chain style attacks on shared components.
Immediate actions for security and IT teams
Security and IT teams should treat these patches as emergency updates, especially for high-risk user groups. Priorities should include:
- Enforce rapid updates
- Push iOS/iPadOS 26.2 fleet-wide via MDM and require reboots; enforce equivalent macOS, watchOS, tvOS, visionOS, and Safari updates.
- Track patch compliance for WebKit/Safari across all Apple endpoints, not just phones, and set short SLAs for closure.
- Harden and monitor high‑value devices
- Identify VIP / high-risk users and validate they have received the updates; consider additional monitoring and reduced browser attack surface for these devices.
- Hunt for indicators of compromise such as unusual browser crashes, abnormal WebKit processes, and anomalous outbound connections around the time of suspected targeting.
- Integrate into vulnerability workflows
- Map CVE-2025-43529 and CVE-2025-14174 into existing KEV-inspired prioritization, treating them on par with other actively exploited zero-days in mobile and browser stacks.
- Ensure vulnerability scanners, asset inventories, and mobile management platforms correctly flag pre‑26 iOS/iPadOS and unpatched Safari instances as non-compliant.
By closing the patch gap quickly and baking these CVEs into ongoing vulnerability management, organizations can reduce exposure to current campaigns and make it harder for future WebKit and browser-engine zero-days to gain a foothold.
