CVE-2026-43670

Published: Aug 25, 2026Modified: Aug 27, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy.

Affected (6)

Products: Apple: Ipados, Iphone Os, Macos, Safari

4 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	Before 18.7.9
Apple Ipados	From 26.0 to 26.5
Apple Iphone Os	Before 18.7.9
Apple Iphone Os	From 26.0 to 26.5
Apple Macos	From 26.0 to 26.5
Apple Safari	Before 26.5