Apple says it fixed zero-day flaws used for 'sophisticated' attacks

Date:
Mon, 15 Dec 2025 16:26:00 +0000

Description:
Two bugs in WebKit apparently abused in highly sophisticated attackshave been fixed.

FULL STORY ======================================================================Apple patches two WebKit zerodays (CVE202543529 and CVE202514174) used in a highly targeted attack Flaws were jointly uncovered by Google TAG and Apple, with Chrome receiving a parallel fix Updates span iOS, iPadOS, macOS, watchOS, tvOS, visionOS, and Safari, with users urged to patch quickly

Apple fixed two zero-day vulnerabilities exploited in an extremely sophisticated attack which, all things considered, could have been a cyber-espionage attack against one, or a handful of, high-profile
individuals.

In a new security advisory, Apple said it deployed a patch for a use-after-free remote code execution (RCE) vulnerability in WebKit, as well
as a WebKit memory corruption flaw.

WebKit is Apples browser engine responsible for rendering web pages. It
powers Safari on macOS, iOS, and iPadOS, and is used by all browsers on
iPhone and iPad. Fixes deployed

The two bugs are now tracked as CVE-2025-43529, and CVE-2025-14174.

"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26," Apple's security bulletin says.

Whats interesting is that both bugs were discovered by Google's Threat Analysis Group (TAG) (Apple also credited itself for the second flaw) - Googles specialized cybersecurity arm which tracks and monitors primarily state-sponsored threat actors.

Its also curious that at the same time, Google fixed the bug with the same identifier - CVE-2025-14174 - in Chrome. This suggests the two companies worked together to mitigate the risk, which is not surprising, but also not that common, and could indicate that the exploit was quite severe.

The devices impacted by these flaws include iPhone 11 and later, iPad Pro 12-9-inch (3rd generation and later), iPad Pro 11-inch (1st generation and later), iPad Air (3rd generation and later), iPad (8th generation and later), and iPad mini (5th generation and later).

It was fixed in OS 26.2 and iPadOS 26.2, iOS 18.7.3 and iPadOS 18.7.3, macOS Tahoe 26.2, tvOS 26.2, watchOS 26.2, visionOS 26.2, and Safari 26.2.

While the chances of ordinary people being targeted through these flaws are somewhat slim, both companies still suggest everyone apply the fix as soon as possible.

Via BleepingComputer

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the
Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.



======================================================================
Link to news story: https://www.techradar.com/pro/security/apple-says-it-fixed-zero-day-flaws-used -for-sophisticated-attacks


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)