Update The iPhone, Apple Confirmed due to zero-days

Two WebKit zero-days: CVE-2025-43529 and CVE-2025-14174 — technical deep dive and mitigation guide

Short summary: In December 2025 Apple released emergency security updates that fix two WebKit vulnerabilities — CVE-2025-43529 and CVE-2025-14174 — that were reported to have been exploited in the wild in highly targeted attacks. One is a WebKit memory-corruption issue disclosed by Google’s Threat Analysis Group (TAG) and Apple; the other is tied to an ANGLE (graphics/renderer) out-of-bounds condition that Google patched in Chrome and that has been added to CISA’s Known Exploited Vulnerabilities catalog. Both can be triggered by processing crafted web content (i.e., simply visiting a malicious page) and therefore warrant immediate patching.

Timeline

Dec 10–12, 2025: Google shipped emergency Chrome updates that included a high-severity ANGLE/graphics bug (CVE-2025-14174 referenced in Chrome release notes).
Dec 12, 2025: Apple published iOS/iPadOS/macOS security updates (iOS/iPadOS 26.2, macOS Tahoe 26.2, and related updates) which list CVE-2025-43529 and CVE-2025-14174 in WebKit advisories and note possible exploitation against targeted individuals.
Dec 12, 2025: NVD published CVE-2025-14174 and CISA added it to the KEV catalog with required actions for agencies (due date Jan 2, 2026).

What they are

CVE-2025-43529 (WebKit) — described by Apple as a memory corruption issue in WebKit; Apple credits Google TAG for reporting. Processing maliciously crafted web content may lead to memory corruption — Apple notes it may have been exploited in extremely sophisticated attacks against targeted individuals. WebKit bugzilla: 303614.
CVE-2025-14174 (WebKit / ANGLE) — described as a use-after-free / out-of-bounds memory access in the graphics pipeline (ANGLE) that Google patched in Chrome; Apple lists the same CVE in its WebKit advisories and credits Apple + Google TAG on some disclosures. This vulnerability has a high severity rating and has been added to CISA’s Known Exploited Vulnerabilities catalog. In Chromium/Chrome the issue is tracked against ANGLE’s Metal renderer and was patched in Chrome 143.0.7499.110 (Mac).

Technical detail — what’s going on under the hood

Common attack surface (why WebKit/ANGLE matters)

Both issues are reachable through the web rendering stack — WebKit for Safari-based clients and ANGLE (used by Chromium variants) in the GPU/renderer path. A crafted HTML page or web resource can cause the browser’s renderer to process malformed input that leads to memory corruption (use-after-free or out-of-bounds access). Because modern browsers separate rendering into multiple processes and accelerate graphics using GPU interfaces (ANGLE/Metal), bugs in those components can be used to corrupt memory in the renderer process and — in sophisticated exploit chains — escalate to arbitrary code execution.

CVE-2025-43529 — memory corruption

Apple’s advisory says the issue was addressed with improved validation and that processing maliciously crafted web content may lead to memory corruption. The advisory explicitly notes the possibility of targeted exploitation against specific individuals on older iOS versions. The bug is tracked in WebKit Bugzilla as 303614. The exact memory corruption pattern is not public in detail (Apple typically limits exploit details for active in-the-wild bugs).

CVE-2025-14174 — ANGLE out-of-bounds / use-after-free summary

Google’s Chrome release notes and NVD describe this as an out-of-bounds memory access in ANGLE (the graphics abstraction used to implement WebGL/OpenGL ES and accelerate rendering), allowing remote attackers to cause memory corruption via crafted HTML. Chromium/Google gave it high severity, and NVD/CISA list it as a high-severity vulnerability that was exploited in the wild. Chromium’s release note ties it to bug number 466192044 and reports patches in Chrome 143.0.7499.109/110. Apple’s WebKit advisory also lists CVE-2025-14174 and links it to use-after-free issues in WebKit (Bugzilla 302502).

Evidence of exploitation (what vendors say)

Apple: “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26.” (this language appears next to both CVE entries in Apple’s security pages).
Google / Chromium: Google stated an exploit for the ANGLE bug existed in the wild and pushed an emergency Chrome update. NVD also records active exploitation and CISA added CVE-2025-14174 to its KEV catalog.

Severity & practical impact

These vulnerabilities are high risk because they can be triggered by rendering web content (no file or user authentication needed beyond visiting a page), and memory corruption in rendering/ANGLE code often leads to arbitrary code execution in the renderer process. That can be leveraged as the first step in a chain that escapes sandboxes or installs spyware on targeted devices. NVD / CISA classify the ANGLE issue as High (CISA ADP scored it CVSS v3.1 8.8 by ADP).

Affected products / versions

Apple platforms: iOS, iPadOS, macOS, tvOS, watchOS, visionOS — Apple’s security pages list the patched OS releases (iOS/iPadOS 26.2, macOS Tahoe 26.2, other platform-specific packages). Apple lists both CVEs in those advisories and the relevant WebKit Bugzilla IDs.
Chromium/Chrome (desktop): Chrome versions prior to 143.0.7499.110 (Mac) / 143.0.7499.109 (Linux/Windows variants) were affected by the ANGLE bug and should be updated. Many Chromium-based browsers share ANGLE and may be impacted; vendors released patches in December 2025.

Indicators of compromise (IoCs) & detection suggestions

Vendors have not published public exploit code or many technical IoCs (common for in-the-wild zero-days), but you can look for behavioural and telemetry indicators:

Unexplained crashes of Safari, embedded WebKit hosts, or the browser renderer process after visiting web content. Frequent renderer crashes occurring before a device update in targeted environments are suspicious.
Network telemetry showing redirects to short-lived or obscure domains serving HTML/JS payloads shortly before device compromise.
Process anomalies: renderer processes that spawn unexpected child processes or trigger unusual system calls after rendering web content (may indicate an exploit chain).
Endpoint EDR alerts tied to memory corruption, execution of unsigned code, or persistence mechanisms appearing soon after web activity.

For enterprise detection: correlate browser crashes + network logs (URL referrers) + EDR process traces. If you have packet captures, look for unusual HTML with large or malformed WebGL/Canvas/texture data which may be part of an ANGLE exploit attempt. (Note: vendors typically withhold exact exploit payloads for active zero-days.)

Immediate mitigation steps (what you should do now)

Patch immediately — Apply vendor updates now: update iOS/iPadOS to 26.2 (or the latest Apple patch), macOS to Tahoe 26.2, update Safari and all Apple device OS builds that have the WebKit fix. For Chrome/Chromium-based browsers, update to the Chrome 143.x series that includes the ANGLE fix (143.0.7499.110 or newer for affected platforms). Apple and Google both shipped fixes in December 2025.
Harden browsing — Where updates cannot be applied immediately:
- Block or filter untrusted web content via web proxies or secure web gateways (filter/deny pages that render complex WebGL/ANGLE content from untrusted origins).
- Disable JavaScript for high-risk users or use browser features/extensions that allow per-site JS control (temporary mitigation for targeted endpoints).
Monitor & isolate — For suspected compromises, isolate devices from the network, capture memory and process dumps (for forensic analysis), and consult vendor/incident response guidance.
Follow CISA/agency guidance — CVE-2025-14174 is in CISA’s KEV catalog; follow required actions if you’re a U.S. federal civilian agency (apply mitigations per vendor instructions or discontinue use where mitigations are unavailable)