A bug in WebKit, the engine that shows web pages in Safari and every iPhone browser, let a booby-trapped web page run code on the device. Apple says it was used against specific people. Apple fixed it on December 12, 2025.
- Status
- Patched: update now
- Being attacked?
- Yes[1]
- Severity
- High
- Updated
Apple says it may have been used in an extremely sophisticated attack against specific people. CISA lists it as used in real attacks (added Dec 15, 2025). Severity: Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked). First reported .
Am I affected?
You are at risk if your Mac runs macOS Tahoe older than 26.2 and Safari older than 26.2, or your iPhone runs iOS 26 older than 26.2.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| macOS | Mac | macOS Tahoe before 26.2 | 26.2 (Tahoe)[1][2] On older macOS (Sequoia, Sonoma), installing Safari 26.2 fixes it. |
| Safari | Mac | Safari before 26.2 | 26.2[2] |
| iPhone and iPad (iOS) | iPhone / iPad | iOS and iPadOS 26 before 26.2 | iOS 26.2[3] |
How to check your version
These checks only look. They do not change anything on your computer.
macOS on Mac
Easy way: Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.
Or type this in TerminalRead-only. It only reads the version and changes nothing.
sw_vers -productVersion
Safari on Mac
Easy way: Open Safari. Menu bar: Safari > About Safari.
Or type this in TerminalRead-only. It only reads the version and changes nothing.
mdls -name kMDItemVersion "/Applications/Safari.app"
iPhone and iPad (iOS) on iPhone / iPad
Easy way: On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.
How to fix it
- Click the Apple menu > System Settings > General > Software Update.
- Install the update it offers.
- Restart your Mac when asked.
- On iPhone or iPad: Settings > General > Software Update.
More on each app: Is my Mac up to date?, Is my Safari up to date?, Is my iPhone up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/apple-webkit-attacked-bug-dec-2025.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2025-43529, CVE-2025-14174
Sources
- MakerApple: About the security content of macOS Tahoe 26.2 (Dec 12, 2025)
- MakerApple: About the security content of Safari 26.2 (Dec 12, 2025)
- MakerApple: About the security content of iOS 26.2 and iPadOS 26.2 (Dec 12, 2025)
- CISACISA: Known Exploited Vulnerabilities catalog entry for CVE-2025-43529 (added 2025-12-15) (Dec 15, 2025)
- NVDNVD: CVE-2025-43529 (Dec 12, 2025)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.