CVE-2026-43735 is a high-severity vulnerability in Apple Safari and related Apple operating systems that permits a malicious website to exfiltrate data cross-origin. The issue was resolved by Apple through improved validation checks and fixed in Safari 26.5.2 and equivalent OS updates. The vulnerability is associated with CWE-352 (Cross-Site Request Forgery). Exploitation requires user interaction (UI:R) but no privileges and can lead to high confidentiality and integrity impact without affecting availability. No vendor advisory explicitly states the remediation level, but the fix is included in the specified versions.

Successful exploitation allows a malicious website to exfiltrate sensitive data from other origins, compromising confidentiality and integrity of user data in Safari browsers and affected Apple OS environments prior to the fixed versions. There is no impact on availability. No known exploits have been reported in the wild at this time.

Update Apple Safari to version 26.5.2 or later. Similarly, update iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS to versions 26.5.2 or 26.6 as applicable. These updates contain the official fix with improved checks to prevent cross-origin data exfiltration. Patch status is confirmed by the vendor through fixed version releases.