Apple patches two ‘realistically exploited’ vulnerabilities on iPhone

Two security vulnerabilities, codenamed CVE-2025-43529 and CVE-2025-14174, are both related to WebKit – the tool behind the Safari browser that runs on most Apple products such as iOS, iPadOS, macOS… In some cases, simply accessing a malicious website is enough to trigger an attack.

Among them, CVE-2025-43529 is a use-after-free vulnerability in WebKit, which can trigger arbitrary code execution attacks when the device processes maliciously generated web content. That is, it allows attackers to run their own command lines on the device by tricking the browser into mishandling memory. The vulnerability was discovered by Google’s Threat Analysis team.

CVE-2025-14174 is related to WebKit memory. According to Apple, the vulnerability has a milder impact, does not help hackers execute malicious commands directly but can “combine with other vulnerabilities to completely weaken the device”.

In both cases, Apple confirmed “illegal exploits are taking place in the wild”, including “extremely sophisticated” attacks targeting specific individuals. The company said it fixed the bug with tweaks, improving WebKit’s memory management and better authentication checks, but did not describe the details, nor the victims who were attacked.

The patch is deployed on all latest versions of iOS, iPadOS, macOS, Safari, watchOS, tvOS, and visionOS. Apple recommends that users update immediately to avoid threats.