CVE-2026-43676

Overview

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected Safari crash

Researchers: Tommy DeVoss from Braze Security Team (@thedawgyg), Mateusz Krzywicki (iVerify.io), dr3dd

Background

Advisory: Apple Security Advisory

Fix not public. The WebKit fix for this bug is embargoed or not yet disclosed. The bug ID is confirmed from the Apple advisory, but no public commit references it.

Root Cause Analysis

An out-of-bounds access issue was addressed with improved bounds checking.

Audit Directions

When auditing for this vulnerability, focus on: (1) similar patterns in the patched functions and nearby code, (2) missing or insufficient bounds checks on user-controlled input, (3) unvalidated type conversions and pointer arithmetic, (4) edge cases not exercised by tests, and (5) copy-paste variants of the vulnerable logic elsewhere.