We’re back with our look at the Apple macOS and iOS security updates. As this is a new feature for us, please let us know your feedback on the blog.
For Jun 2026, Apple released 37 unique CVEs across iOS 26.5.2 / iPadOS 26.5.2, macOS Tahoe 26.5.2, Safari 26.5.2. Since Apple doesn’t provide CVSS scores or other severity information, we’re left to speculate on which of these bugs is the most severe. The overwhelming majority (31 of 37) are WebKit/WebRTC bugs reachable through malicious web content. Most of those are crash/DoS bugs rather than code execution, so the real risk lives in the small set of kernel bugs and the handful of WebKit sandbox escapes. However, there are a couple that stand out.
- CVE-2026-43724 (Kernel) – According to Apple, “An app may be able to cause unexpected system termination or write kernel memory.” A kernel memory write is the highest-value primitive here: it's the privilege-escalation half of a full exploit chain and leads to complete device control. The bug was credited to Hyunwoo Kim (@v4bel), who is known to be a serious kernel researcher.
- CVE-2026-39868 (Kernel) – Another kernel bug, this one could “cause unexpected system termination or corrupt kernel memory.” This is kernel memory corruption, and notably credited to a roster of elite offensive researchers (STAR Labs, Positive Technologies, Baidu Security). This kind of attribution usually signals a weaponizable, possibly Pwn2Own-grade bug rather than a theoretical crash.
- CVE-2026-43725 / CVE-2026-43701 (WebKit) – Apple states these bugs could allow a website to process restricted web content outside the sandbox. I'm flagging this sandbox-escape pair over the many WebKit crash bugs because a sandbox escape is the bridge that turns a web-content bug into a path toward the kernel issues above. It's the most dangerous remotely-triggered class in the release.
Here’s a look at all the bugs released by Apple this month:
| CVE ID | Component | Impact | iOS 26.5.2 / iPadOS 26.5.2 | macOS Tahoe 26.5.2 | Safari 26.5.2 |
|---|---|---|---|---|---|
| CVE-2026-43743 | IOGPUFamily | An app may be able to cause unexpected system termination | Yes | Yes | No |
| CVE-2026-39868 | Kernel | An app may be able to cause unexpected system termination or corrupt kernel memory | Yes | Yes | No |
| CVE-2026-43722 | Kernel | An app may be able to leak sensitive kernel state | Yes | Yes | No |
| CVE-2026-43724 | Kernel | An app may be able to cause unexpected system termination or write kernel memory | Yes | Yes | No |
| CVE-2026-43703 | libxslt | Processing maliciously crafted web content may lead to an unexpected process crash | Yes | Yes | No |
| CVE-2026-43706 | libxslt | Processing maliciously crafted web content may lead to an unexpected process crash | Yes | Yes | No |
| CVE-2026-43704 | Web Extensions | A malicious web extension may be able to cause an unexpected process crash | Yes | Yes | Yes |
| CVE-2026-39872 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | Yes | Yes | Yes |
| CVE-2026-43663 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | Yes | Yes | Yes |
| CVE-2026-43676 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | Yes | Yes | Yes |
| CVE-2026-43699 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | Yes | Yes | Yes |
| CVE-2026-43700 | WebKit | Processing maliciously crafted web content may disclose sensitive user information | Yes | Yes | Yes |
| CVE-2026-43701 | WebKit | A malicious website may be able to process restricted web content outside the sandbox | Yes | Yes | Yes |
| CVE-2026-43705 | WebKit | Processing maliciously crafted web content may lead to memory corruption | Yes | Yes | Yes |
| CVE-2026-43707 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | Yes | Yes | Yes |
| CVE-2026-43708 | WebKit | A malicious website may exfiltrate data cross-origin | Yes | Yes | Yes |
| CVE-2026-43709 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | Yes | Yes | Yes |
| CVE-2026-43712 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | Yes | Yes | Yes |
| CVE-2026-43713 | WebKit | Visiting a website may leak sensitive data | Yes | Yes | Yes |
| CVE-2026-43715 | WebKit | Processing maliciously crafted web content may lead to memory corruption | Yes | Yes | Yes |
| CVE-2026-43716 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | Yes | Yes | Yes |
| CVE-2026-43725 | WebKit | A malicious website may be able to process restricted web content outside the sandbox | Yes | Yes | Yes |
| CVE-2026-43726 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | Yes | Yes | Yes |
| CVE-2026-43727 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | Yes | Yes | Yes |
| CVE-2026-43731 | WebKit | Processing maliciously crafted web content may lead to memory corruption | Yes | Yes | Yes |
| CVE-2026-43732 | WebKit | Processing maliciously crafted web content may disclose sensitive user information | Yes | Yes | Yes |
| CVE-2026-43734 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | Yes | Yes | Yes |
| CVE-2026-43735 | WebKit | A malicious website may exfiltrate data cross-origin | Yes | Yes | Yes |
| CVE-2026-43740 | WebKit | Processing maliciously crafted web content may result in the disclosure of process memory | Yes | Yes | Yes |
| CVE-2026-43742 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | Yes | Yes | Yes |
| CVE-2026-43745 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | Yes | Yes | Yes |
| CVE-2026-43720 | WebKit Canvas | Processing maliciously crafted web content may lead to an unexpected Safari crash | Yes | Yes | Yes |
| CVE-2026-43721 | WebKit Storage | A malicious website may be able to silently hijack clipboard data | Yes | Yes | Yes |
| CVE-2026-28979 | WebRTC | Processing maliciously crafted web content may lead to an unexpected process crash | Yes | Yes | Yes |
| CVE-2026-43717 | WebRTC | Processing maliciously crafted web content may lead to an unexpected Safari crash | Yes | Yes | Yes |
| CVE-2026-43718 | WebRTC | Processing maliciously crafted web content may lead to an unexpected Safari crash | Yes | Yes | Yes |
| CVE-2026-43746 | WebRTC | Processing maliciously crafted web content may lead to an unexpected Safari crash | Yes | Yes | Yes |
We’ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.
SOCIAL SHARE CARD GENERATOR