Cross-Origin Data Exfiltration Vulnerability in Safari and iOS Products
CVE-2026-43735
What is CVE-2026-43735?
A vulnerability has been identified in Safari and related Apple products that allows malicious websites to potentially exfiltrate sensitive data across different origins. The issue has been remediated with enhanced verification protocols in the latest versions, ensuring that requests made to external domains cannot access data associated with the user's browser session. Users are urged to update to the latest versions of affected products to maintain security and protect their data from potential exploitation.
Affected Version(s)
iOS and iPadOS 0 < 26.5.2
macOS 0 < 26.5.2
Safari 0 < 26.5.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.