CVE-2026-43704

Overview

Advisory: Apple Security Advisory

Impact:

Description: A malicious web extension may be able to cause an unexpected process crash

Researchers: dr3dd

Attribute	Value
CVE	CVE-2026-43704
Bugzilla	314642
Component	WebKit
Bug Class	UAF
Severity	medium
Commit	1759ab219c63940b…
Advisory	Apple Advisory

Root Cause Analysis

A use-after-free issue was addressed with improved memory management.

Files Changed

Source Files

• Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIDevToolsExtensionPanelCocoa.mm
• Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIPortCocoa.mm

Test Files

• Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIRuntime.mm