This vulnerability (CVE-2026-43660) involves a validation issue in Apple Safari that can cause the Content Security Policy to not be enforced when processing maliciously crafted web content. The CSP is a critical security feature designed to restrict resources the browser is allowed to load, thereby mitigating cross-site scripting and data injection attacks. The flaw has been addressed by Apple through improved validation logic and fixed in Safari 26.5 and related OS updates. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges or user interaction required, and a high impact on confidentiality. No integrity or availability impacts are noted. No public exploits are currently known.

If exploited, this vulnerability could allow an attacker to bypass the Content Security Policy in Safari, potentially exposing users to data theft or unauthorized data disclosure. The confidentiality of user data could be compromised. However, there is no indication of impact on data integrity or system availability. No known exploits have been reported in the wild so far.

Apple has released official fixes for this vulnerability in Safari 26.5 and corresponding updates for iOS 18.7.9, iPadOS 18.7.9, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Users and administrators should apply these updates promptly to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.