iOS 26.5.2 Security Update Advisory: Multiple Vulnerabilities in WebKit, Kernel, and libxslt

Vulnerability Overview The iOS 26.5.2 and iPadOS 26.5.2 updates include multiple security fixes affecting various components and vulnerabilities. These vulnerabilities may impact system stability, data security, and privacy protection. Scope of Impact IOGPUPamily - Affected Devices: iPhone 11 and later, iPad Pro 12.9-inch (3rd generation) and later, iPad Pro 11-inch (1st generation) and later, iPad Air (3rd generation) and later, iPad (8th generation) and later, iPad mini (5th generation) and later. - Impact: An app may cause an unexpected system termination. - Description: A race condition was addressed by improving state handling. - CVE-ID: CVE-2026-43743 Kernel - Affected Devices: Same as above. - Impact: An app may cause an unexpected system termination or write to kernel memory. - Description: The issue was addressed by improving input validation. - CVE-ID: CVE-2026-43724 Kernel - Affected Devices: Same as above. - Impact: An app may disclose sensitive kernel state. - Description: The issue was addressed by improving input validation. - CVE-ID: CVE-2026-43722 Kernel - Affected Devices: Same as above. - Impact: An app may cause an unexpected system termination or corrupt kernel memory. - Description: The issue was addressed by improving input validation. - CVE-ID: CVE-2026-39868 libxslt - Affected Devices: Same as above. - Impact: Processing maliciously crafted web content may cause an unexpected process termination. - Description: A use-after-free vulnerability was addressed by improving memory management. - CVE-ID: CVE-2026-43706 libxslt - Affected Devices: Same as above. - Impact: Processing maliciously crafted web content may cause an unexpected process termination. - Description: The issue was addressed by improving memory handling. - CVE-ID: CVE-2026-43703 Web Extensions - Affected Devices: Same as above. - Impact: A malicious web extension may cause an unexpected process termination. - Description: A use-after-free vulnerability was addressed by improving memory management. - CVE-ID: CVE-2026-43704 WebKit - Affected Devices: Same as above. - Impact: Processing maliciously crafted web content may disclose sensitive user information. - Description: An origin cross-site issue was addressed by improving secure origin tracking. - CVE-ID: CVE-2026-43700 WebKit - Affected Devices: Same as above. - Impact: A malicious website may extract data across origins. - Description: The issue was addressed by improving checks. - CVE-ID: CVE-2026-43735 WebKit - Affected Devices: Same as above. - Impact: Processing maliciously crafted web content may cause an unexpected process termination. - Description: A use-after-free vulnerability was addressed by improving memory management. - CVE-ID: CVE-2026-43734 WebKit - Affected Devices: Same as above. - Impact: Processing maliciously crafted web content may cause an unexpected Safari crash. - Description: A use-after-free vulnerability was addressed by improving memory management. - CVE-ID: CVE-2026-43727 WebKit - Affected Devices: Same as above. - Impact: A malicious website may process restricted web content outside the sandbox. - Description: The issue was addressed by improving input validation. - CVE-ID: CVE-2026-43725 WebKit - Affected Devices: Same as above. - Impact: Processing maliciously crafted web content may cause an unexpected process termination. - Description: The issue was addressed by improving memory management. - CVE-ID: CVE-2026-43669 WebKit - Affected Devices: Same as above. - Impact: Processing maliciously crafted web content may cause an unexpected Safari crash. - Description: The issue was addressed by improving memory handling. - CVE-ID: CVE-2026-39872 WebKit - Affected Devices: Same as above. - Impact: Processing maliciously crafted web content may cause an unexpected Safari crash. - Description: A buffer overflow was addressed by improving boundary checks. - CVE-ID: CVE-2026-43676 WebKit - Affected Devices: Same as above. - Impact: Processing maliciously crafted web content may cause process memory leakage. - Description: The issue was addressed by improving memory handling. - CVE-ID: CVE-2026-43740 WebKit - Affected Devices: Same as above. - Impact: Visiting a website may disclose sensitive data. - Description: A permission issue was addressed by imposing additional restrictions. - CVE-ID: CVE-2026-43713 WebKit - Affected Devices: Same as above. - Impact: A malicious website may extract data across origins. - Description: The issue was addressed by improving input validation. - CVE-ID: CVE-2026-43708 Remediation All the above vulnerabilities have been addressed via corresponding security updates. Users are advised to upgrade to iOS 26.5.2 and iPadOS 26.5.2 as soon as possible to ensure device security. POC Code or Exploit Code No specific POC code or exploit code is provided in this document.

Goal Reached Thanks to every supporter — we hit 100%!

iOS 26.5.2 Security Update Advisory: Multiple Vulnerabilities in WebKit, Kernel, and libxslt