CVE-2026-43670 in iOS
Summary
by MITRE • 08/25/2026
A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability described involves a flaw in the enforcement of Content Security Policy within AudioWorklet contexts in Apple's WebKit engine. Content Security Policy is a critical security feature that helps detect and mitigate certain types of attacks, including Cross-Site Scripting XSS and data injection attacks by specifying approved sources for content loading. However, this specific issue allowed maliciously crafted web content to bypass these protections when executed within AudioWorklet contexts. An attacker could exploit this weakness by crafting specialized web pages or scripts that leverage the AudioWorklet API to execute unauthorized code or inject malicious payloads, effectively circumventing the intended security boundaries established by CSP directives.
This type of vulnerability is classified under CWE-150 Improper Neutralization of Escape Sequences in Headers and potentially aligns with ATT&CK technique T1059 Command and Scripting Interpreter if it leads to arbitrary code execution or data exfiltration. The core technical flaw lies in the browser's handling of script evaluation contexts, where the AudioWorklet interface did not strictly adhere to CSP restrictions as rigorously as other JavaScript execution environments. This inconsistency creates a gap that sophisticated attackers can exploit to perform actions such as stealing sensitive user data, performing unauthorized transactions, or defacing web applications without triggering standard security alerts associated with CSP violations.
The operational impact of this vulnerability is significant for users relying on Safari and related Apple operating systems for secure browsing activities involving audio processing features. Since AudioWorklets are often used in complex web applications such as music production tools, real-time communication platforms, or interactive media experiences, the potential for abuse extends beyond simple script injection to more severe consequences like session hijacking or persistent malware installation if combined with other vulnerabilities. Users accessing untrusted or compromised websites that utilize these audio processing features face a heightened risk of security breaches due to the bypassed protections.
To mitigate this risk, it is imperative to update Safari and associated operating systems including iOS iPadOS macOS Tahoe to their latest versions as specified in Apple’s security updates. These releases contain improved enforcement mechanisms for Content Security Policy across all execution contexts ensuring that AudioWorklet scripts are subject to the same rigorous CSP checks as standard JavaScript environments. Additionally developers should ensure their applications implement robust CSP headers and regularly audit third-party libraries or plugins that interact with audio APIs to minimize exposure to such bypass techniques until patches are applied.