Apple dropped a big batch of security fixes on Monday, addressing more than three dozen vulnerabilities across iOS, macOS, and Safari. The headline: four WebKit bugs were discovered not by human researchers, but by AI tools.
OpenAI Codex Security found three of them. CVE-2026-43707 is a memory corruption issue that could crash a process via malicious web content. CVE-2026-43716 could cause an unexpected Safari crash. CVE-2026-43745 is an out-of-bounds write, also triggering Safari crashes. All three were fixed with improved memory handling or input validation.
The fourth AI-discovered flaw, CVE-2026-43715, is a use-after-free issue leading to memory corruption. Anthropic researchers Milad Nasr and Nicholas Carlini, working with Claude, get credit for that one.
Beyond the AI-found quartet, Apple patched roughly 30 other WebKit vulnerabilities. These include a use-after-free in WebKit Canvas (CVE-2026-43720) and a sandbox escape via malicious web content (CVE-2026-43725). Three kernel bugs also got fixed: CVE-2026-43722 leaks sensitive kernel state, CVE-2026-43724 can cause system termination or write kernel memory, and CVE-2026-39868 corrupts kernel memory. Security researcher Hyunwoo Kim, known for the Dirty Frag discovery, reported two of those.
None of these vulnerabilities have been reported as actively exploited. The updates are available for iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2.
Apple told Reuters it is releasing updates earlier than usual because AI tools can shrink the gap between vulnerability discovery and weaponization to hours. The company is adapting to a reality where patch speed matters more than ever.
References
- CVE-2026-43707 – NVD
- CVE-2026-43716 – NVD
- CVE-2026-43745 – NVD
- CVE-2026-43715 – NVD
- CVE-2026-43720 – NVD
- CVE-2026-43725 – NVD
- CVE-2026-43722 – NVD
- CVE-2026-43724 – NVD
- CVE-2026-39868 – NVD
- Apple Security Updates
- iOS 26.5.2 Security Advisory
- macOS Tahoe 26.5.2 Security Advisory
- Safari 26.5.2 Security Advisory
