Apple releases urgent updates against two zero-day flaws exploited in targeted attacks
Apple has released emergency security updates to fix two zero-day vulnerabilities in the WebKit engine. The failures, identified asCVE-2025-43529 e CVE-2025-14174, were exploited in sophisticated attacks against specific individuals.
The patches arrive in versions such as iOS 26.2, iPadOS 26.2, macOS Tahoe 26.2 and other company platforms.
The exploitation occurred through malicious web content, without the need for user interaction beyond loading a page.
- iPhone 11 and later models
- iPad
- iPad Air (3rd generation and later)
- iPad (8th generation and later)
- iPad mini (5th generation and later)
Vulnerability details
A CVE-2025-43529This is a use-after-free error in WebKit.
This issue allows arbitrary code execution when processing malicious web content.
Google Threat Analysis Group researchers identified the flaw, which was fixed with improvements in memory management.
A CVE-2025-14174involves memory corruption, also triggered by crafted web content.
On the same topic: Apple advises urgent iOS update against web attacks that exploit old versions
Credits go to the Apple and Google TAG teams.
The fix included improved validations.
Both vulnerabilities affect WebKit, the central component for rendering web content in Safari and apps from the Apple ecosystem.
Versions with available fixes
Apple made updates available on multiple platforms simultaneously.
Learn more: Users’ refusal to update iPhone due to aesthetics opens the door to serious attacks in WebKit flaw
- iOS 26.2 and iPadOS 26.2
- iOS 18.7.3 and iPadOS 18.7.3 (for older devices)
- macOS Tahoe 26.2
- tvOS 26.2, watchOS 26.2 and visionOS 26.2
- Safari 26.2
The company confirmed that the exploits occurred in versions prior to iOS 26.
Coordination with Google highlighted the severity, as theCVE-2025-14174also affected Chrome, receiving a separate patch.
Coordination between Apple and Google
The two companies worked together to identify and correct the issue.
Google Threat Analysis Group, which specializes in advanced threats, directly contributed to both flaws.
A CVE-2025-14174initially appeared as a vulnerability in the ANGLE component of Chrome.
Later updates linked the issue to WebKit on the Apple platform.
This collaboration reflects shared concerns with active explorations.
See Also
More on this story: IPhone and Mac receive automatic fix for critical vulnerability in Safari browser
Researchers note that TAG’s involvement suggests possible links to state actors or spyware campaigns.
Affected devices and range
The vulnerabilities impact a wide range of Apple hardware.
Recent iPhone and iPad models remain vulnerable without the update.
WebKit integrates deeply into the system, allowing apps to display web content without opening Safari.
Attacks only required the loading of a malicious page.
Full coverage: News (EN)
Devices running older versions of iOS face greater risk.
Year with multiple corrected zero-days
2025 saw several zero-day corrections in Apple.
These incidents add up to at least seven to nine cases explored in the real world.
Previous failures affected components such as Kernel and ImageIO.
The frequency indicates a growing trend of attacks targeting mobile platforms.
Learn more: Apple releases first background security improvement, fixes WebKit flaw
Experts highlight the sophistication of these campaigns, similar to past operations with exploit chains.
Recommendations for users
Users must install updates immediately.
On your iPhone or iPad, go to Ajustes > Geral > Atualização of Software.
In Macs, use Preferências from Sistema > Atualização from Software.
Apple reinforces that, although the attacks are targeted, applying the patch prevents future risks.
Devices incompatible with new versions receive separate security updates when possible.
