CVE-2026-43670CWE-693

CVE-2026-43670

High · published August 26, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.5th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-08-26T00:16Z
Affected products (6)
ProductVersionsFixed in
apple/safari< 26.526.5
apple/ipados< 18.7.918.7.9
apple/ipados≥ 26.0, < 26.526.5
apple/iphone_os< 18.7.918.7.9
apple/iphone_os≥ 26.0, < 26.526.5
apple/macos≥ 26.0, < 26.526.5
References (4)
https://support.apple.com/en-us/127110 · [email protected]https://support.apple.com/en-us/127111 · [email protected]https://support.apple.com/en-us/127115 · [email protected]https://support.apple.com/en-us/127121 · [email protected]
EPSS history
Timeline
  • 27 AUG 06:31Z
    EPSS moved — → 0%
    epss
  • 25 AUG 19:24Z
    A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts
    cvelistv5