CVE-2026-43670

Analyzed Analyzed - Analysis Complete

Content Security Policy Bypass in Safari

Publication date: 2026-08-25

Last updated on: 2026-08-27

Assigner: Apple Inc.

Description

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-13

NVD

CVE-2026-43670

EUVD

EUVD-2026-65739

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 18.7.9 (exc)
apple	ipados	From 26.0 (inc) to 26.5 (exc)
apple	iphone_os	to 18.7.9 (exc)
apple	iphone_os	From 26.0 (inc) to 26.5 (exc)
apple	macos	From 26.0 (inc) to 26.5 (exc)
apple	safari	to 26.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

CVE-2026-43670 is a Content Security Policy bypass vulnerability in Safari and WebKit for macOS, iOS, and iPadOS. It occurs in AudioWorklet contexts where maliciously crafted web content could bypass security policies due to insufficient enforcement.

Detection Guidance

Detection primarily involves checking the installed versions of Safari, iOS, iPadOS, and macOS Tahoe against the patched versions (Safari 26.5, iOS 18.7.9/iPadOS 18.7.9, iOS 26.5/iPadOS 26.5, macOS Tahoe 26.5). Use system update commands like 'softwareupdate --list' on macOS or 'Settings > General > Software Update' on iOS/iPadOS.

Impact Analysis

This vulnerability could allow attackers to bypass Content Security Policy protections in Safari and WebKit-based browsers. This might enable malicious scripts to execute or access restricted resources, potentially leading to data theft, unauthorized actions, or further exploitation of other vulnerabilities.

Compliance Impact

This vulnerability allows bypassing Content Security Policy (CSP) in AudioWorklet contexts, which could enable unauthorized data exfiltration or script execution. Such bypasses may violate GDPR's data protection requirements by allowing unauthorized access to user data, and HIPAA's security rules by compromising web content integrity in healthcare environments.

Mitigation Strategies

Update affected systems to the latest versions (Safari 26.5, iOS 18.7.9/iPadOS 18.7.9, iOS 26.5/iPadOS 26.5, macOS Tahoe 26.5) immediately. Avoid visiting untrusted websites until updates are applied. Enable automatic updates if not already enabled.

Hi! I’m here to help you understand CVE-2026-43670. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70