CVE-2026-43670

Overview

Advisory: Apple Security Advisory

Impact:

Description: Processing maliciously crafted web content may bypass Content Security Policy

Researchers: lebr0nli of National Yang Ming Chiao Tung University, Security and Systems Lab

Root Cause Analysis

AudioWorklet and PaintWorklet did not inherit the owner document’s CSP, allowing eval() and remote script loading even when CSP blocked them. Fix: WorkletParameters now carries contentSecurityPolicyResponseHeaders; worklet global scopes call applyContentSecurityPolicyResponseHeaders() on creation. WorkerModuleScriptLoader now treats worklet destinations as script-src governed.

Attack Path

1. Step 1

Attacker serves a page with strict CSP blocking eval() and remote scripts.

2. Step 2

Page creates an AudioWorklet or PaintWorklet.

3. Step 3

Worklet runs without inheriting CSP, operating in a policy vacuum.

4. Step 4

Attacker executes eval() or loads remote scripts inside worklet.

5. Step 5

XSS or data exfiltration via attacker-controlled worklet code.

Files Changed

Source Files

• Tools/CISupport/ews-build/twisted_additions.py

Patch Preview

diff --git a/Tools/CISupport/ews-build/twisted_additions.py b/Tools/CISupport/ews-build/twisted_additions.py
index 741927887f39..8d5b80ce72b1 100644
--- a/Tools/CISupport/ews-build/twisted_additions.py
+++ b/Tools/CISupport/ews-build/twisted_additions.py
@@ -241,7 +241,6 @@ def request(cls, url, type=None, params=None, headers=None, logger=None, timeout
         if not url:
             logger('No URL provided\n')
             defer.returnValue(None)
-        logger(f'Accessing {url} with timeout: {timeout}\n')
         hostname = '/'.join(url.split('/', 3)[:3])
         if params:
             url = '{}?{}'.format(url, '&'.join([f'{key}={value}' for key, value in params.items()]))