CVE-2026-43670

Overview

Impact:

Description: Processing maliciously crafted web content may bypass Content Security Policy

Researchers: lebr0nli of National Yang Ming Chiao Tung University, Security and Systems Lab

Background

Advisory: Apple Security Advisory

Attribute	Value
CVE	CVE-2026-43670
Bugzilla	309004
Component	WebKit
Bug Class	CSP Bypass
Severity	high
Advisory	Apple Advisory

Fix not public. The WebKit fix for this bug is embargoed or not yet disclosed. The bug ID is confirmed from the Apple advisory, but no public commit references it.

Root Cause Analysis

AudioWorklet and PaintWorklet did not inherit the owner document’s CSP, allowing eval() and remote script loading even when CSP blocked them. Fix: WorkletParameters now carries contentSecurityPolicyResponseHeaders; worklet global scopes call applyContentSecurityPolicyResponseHeaders() on creation. WorkerModuleScriptLoader now treats worklet destinations as script-src governed.

Attack Path

1. Step 1

Attacker serves a page with strict CSP blocking eval() and remote scripts.

2. Step 2

Page creates an AudioWorklet or PaintWorklet.

3. Step 3

Worklet runs without inheriting CSP, operating in a policy vacuum.

4. Step 4

Attacker executes eval() or loads remote scripts inside worklet.

5. Step 5

XSS or data exfiltration via attacker-controlled worklet code.

Audit Directions

When auditing for this vulnerability, focus on: (1) similar patterns in the patched functions and nearby code, (2) missing or insufficient bounds checks on user-controlled input, (3) unvalidated type conversions and pointer arithmetic, (4) edge cases not exercised by tests, and (5) copy-paste variants of the vulnerable logic elsewhere.