CVE-2026-43670

EUVD-2026-65739
A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 13.12%
Affected Products (NVD)
VendorProductVersion
applesafari
𝑥
< 26.5
appleipados
𝑥
< 18.7.9
appleipados
26.0 ≤
𝑥
< 26.5
appleiphone_os
𝑥
< 18.7.9
appleiphone_os
26.0 ≤
𝑥
< 26.5
applemacos
26.0 ≤
𝑥
< 26.5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
webkit2gtk
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
2.54.0-1
fixed
trixie
vulnerable
trixie (security)
2.54.0-1~deb13u1
fixed
wpewebkit
bookworm
ignored
forky
2.54.0-2
fixed
sid
2.54.0-2
fixed
trixie
ignored
Common Weakness Enumeration
References
https://support.apple.com/en-us/127110
https://support.apple.com/en-us/127111
https://support.apple.com/en-us/127115
https://support.apple.com/en-us/127121