Sunday, November 8, 2026 — 1 issue requires action. If you run none of the software below, you are done.

Affects: Apple Safari / Apple iOS and iPadOS / Apple tvOS / Apple visionOS / Apple watchOS / macOS

1. WebKit use-after-free lets crafted web content run code on Apple devices (CVE-2025-43529)

CISA KEV (due 2026-01-05) · REMOTE CODE EXECUTION · HIGH · CVSS 8.8

A 2026-11-07 report describes a watering-hole campaign in which compromised legitimate websites and imitation portals delivered exploit chains using this n-day to pull cookies, messaging app databases and credentials from devices still on builds older than iOS/iPadOS 18.7.3 or 26.2, so any fleet with unpatched iPhones, iPads or Macs is one page visit from credential theft.

A use-after-free in WebKit means that simply processing a malicious web page can corrupt memory and execute attacker code in the browser context on iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Reports describe it being chained from compromised and look-alike websites, in some cases with no further user interaction after the page loads, to extract cookies, messaging app databases and credentials.

Affected: Apple Safari < 26.2; Apple iOS and iPadOS < 18.7.3; Apple iOS and iPadOS < 26.2; Apple macOS < 26.2; Apple tvOS < 26.2; Apple visionOS < 26.2; Apple watchOS < 26.2

How to Test: Pull the OS and Safari versions from MDM inventory or the device About screen and flag anything below iOS/iPadOS 18.7.3 (older-device branch) or 26.2, macOS 26.2, Safari 26.2, tvOS/visionOS/watchOS 26.2. For compromise, the campaign used injected JavaScript on compromised legitimate websites and convincing imitation portals: review web proxy and DNS logs for visits from unpatched devices to unexpected look-alike portals, and treat any such device as suspect — rotate browser session cookies, messaging app sessions and credentials stored on it.

How to Patch: Update to iOS/iPadOS 26.2 (or 18.7.3 on devices that cannot run 26), macOS 26.2, Safari 26.2 on macOS Sonoma and Sequoia, and tvOS, visionOS and watchOS 26.2; enforce the minimum versions through MDM so stragglers cannot keep browsing on vulnerable builds.

Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · BleepingComputer (2026-11-07) on Sekoia-documented watering-hole campaign exploiting CVE-2025-43529 · VulnCheck XDB public exploit

Full entry with sources →

Read on the web · Every past edition

The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.

Spot an error, or an exploit we missed? Reply here or email [email protected].