CVE-2025-43529: Apple Multiple Products WebKit -- Use-After-Free Memory Corruption

Background

WebKit is Apple’s browser engine, the mandatory rendering engine for all browsers on iOS and iPadOS under Apple’s App Store policies. This means that not only Safari, but every third-party browser on iOS — Chrome, Firefox, Edge — uses WebKit under the hood, making WebKit vulnerabilities uniquely impactful on Apple’s mobile platform.

CVE-2025-43529 is a use-after-free (UAF) vulnerability in WebKit that can be triggered by processing maliciously crafted web content, leading to memory corruption and potentially arbitrary code execution. CISA added this to the KEV catalog on 2025-12-15, indicating confirmed active exploitation.

Apple WebKit vulnerabilities are historically targeted by commercial surveillance software vendors and nation-state actors. Zero-day or recently patched WebKit vulnerabilities have been core components of the exploit chains used by spyware tools like Pegasus, Predator, and others, enabling silent device compromise through a single webpage visit.

Technical Mechanism

CWE-416 (Use After Free) in WebKit typically manifests in the JavaScript engine (JavaScriptCore) or DOM processing code. When JavaScript or HTML content manipulates object lifetimes in ways the engine does not anticipate, an object can be freed while a dangling pointer to it remains reachable.

// Conceptual WebKit UAF pattern in DOM node handling
class EventListener {
    Node* m_node;  // may be freed by GC while this object is live
    void dispatch(Event* event) {
        m_node->handleEvent(event);  // UAF: m_node freed before this call
    }
};

// Attacker JavaScript triggers the race:
// let node = document.createElement("div");
// let listener = new CustomEventListener(node);
// node = null; // trigger GC to free node
// // ... then trigger listener dispatch

Through heap grooming techniques, attackers can control the freed memory region, placing their data in the freed slot before the dangling pointer is dereferenced, achieving controlled code execution.

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. Apple has historically been reserved about details of in-the-wild exploitation, typically attributing exploitation to “CVE was exploited in the wild” without specifying threat actors in initial disclosures. However, the cadence and pattern of WebKit UAF vulnerabilities in KEV is consistent with commercial spyware deployment targeting journalists, dissidents, government officials, and executives. Users should treat this as a high-urgency patch.

Impact Assessment

• Code execution in the context of the WebKit renderer process
• Affects all browsers on iOS/iPadOS regardless of vendor (due to WebKit mandate)
• Can be triggered silently by visiting a malicious webpage (zero-click potential in some configurations)
• Memory corruption enabling follow-on privilege escalation
• Used as component of sophisticated mobile device compromise chains

Affected Versions

Remediation Steps

1. Update all Apple devices (iPhone, iPad, Mac, Apple Watch, Apple TV) immediately.
2. Enable automatic updates on all Apple devices via Settings.
3. Apply Safari updates on macOS promptly when released.
4. For high-risk individuals (journalists, executives, activists): consider enabling Apple Lockdown Mode.
5. Avoid visiting untrusted websites on unpatched devices.

Detection Guidance

Log Sources: Mobile device management (MDM) telemetry, iOS syslog/crash logs, network proxy logs.

IOCs: WebKit process crashes on Apple devices; unexpected process spawns from Safari or WKWebView; device reboots following suspicious browsing activity; anomalous network connections from browser processes.

Detection note: iOS exploitation is difficult to detect at the network level due to encrypted traffic; MDM enrollment and Apple Business Manager telemetry provide the best detection surface for enterprise deployments.

Timeline

References

• NVD — CVE-2025-43529
• CISA KEV — CVE-2025-43529
• Apple Security Releases — CVE-2025-43529