CVE-2026-43670

Executive Summary

CVE-2026-43670 is a Content Security Policy (CSP) bypass vulnerability in Apple's WebKit engine, specifically affecting the AudioWorklet execution context. The flaw allows maliciously crafted web content to bypass CSP enforcement, which is a critical security boundary designed to prevent cross-site scripting (XSS) and data injection attacks. The vulnerability affects all Apple platforms that render web content via WebKit, including Safari browser, iOS, iPadOS, and macOS Tahoe. Successful exploitation could enable attackers to execute unauthorized scripts in the context of a victim's browsing session, potentially leading to data theft, session hijacking, or further device compromise. Apple has released fixes across all affected platforms in the versions listed in the advisory.

Technical Analysis

The vulnerability resides in the WebKit JavaScript engine's handling of the AudioWorklet API. AudioWorklet is a Web Audio API feature that allows developers to run custom audio processing code in a dedicated thread using the AudioWorkletProcessor interface. The flaw permits CSP bypass specifically within the AudioWorklet context, meaning that scripts running via this mechanism are not subject to the same CSP restrictions as regular document scripts.

The core issue is insufficient enforcement of Content Security Policy directives when processing scripts loaded into AudioWorklet contexts. In a properly configured environment, CSP directives such as script-src should restrict which scripts are permitted to execute on a page. However, due to a flaw in how WebKit processes AudioWorklet module scripts, the CSP checks are either not applied correctly or are circumvented entirely.

The NVD description indicates this is an "improved enforcement" fix, suggesting that the AudioWorklet execution path had a gap in its security validation logic compared to other script execution contexts. Attackers could leverage this by crafting web content that registers a malicious AudioWorklet module, which then executes without proper CSP validation.

Technical details regarding the specific code path, function names, or exact enforcement logic are not available in the public advisory. The vulnerability class is a "Protection Mechanism Failure" (CWE-693), where a security control (CSP) fails to provide its intended protection in a specific execution context. The attack surface is any web page rendered through WebKit with CSP enabled that also loads AudioWorklet modules.

Affected components include: Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. All versions prior to these releases are potentially vulnerable.

Exploitation Scenarios

No public PoC or exploit code is available for this vulnerability at the time of reporting. The attack chain is inferred from the vulnerability class.

Attack Chain:

1. Reconnaissance/Target Identification: An attacker identifies target victims who use Safari or any WebKit-based browser on Apple platforms (iOS, iPadOS, macOS). The attacker could host malicious content on a website, deliver it via phishing emails containing links, or inject content into a compromised legitimate site.

2. Triggering the Flaw: The attacker crafts a malicious web page containing both a Content Security Policy and AudioWorklet code. The page would register an AudioWorkletProcessor module. Due to the CSP enforcement gap, the module script is loaded and executed despite potentially being disallowed by the page's CSP script-src directive. The attacker could also frame this as a cross-origin inclusion attack, where a malicious script is loaded into a page's AudioWorklet context.

3. Payload/Execution Method: At the vulnerability-class level, the attacker loads a JavaScript payload through the AudioWorklet module mechanism. Since CSP normally would block such scripts, the bypass allows the payload to execute in the context of the page, effectively achieving the same result as a successful XSS attack. The payload could be delivered from an external domain that would normally be blocked by script-src restrictions.

4. Post-Exploitation Impact: Once the malicious script executes, the attacker can perform actions on behalf of the authenticated user within the context of the affected origin. This includes stealing session cookies, accessing DOM data, exfiltrating sensitive information, performing actions with the user's privileges, or potentially escalating to further device compromise depending on other browser/OS vulnerabilities that might be chained.

Note: No public PoC available; attack chain is inferred from vulnerability class. The exact JavaScript APIs and specific CSP directive bypass mechanism are not publicly documented.

Impact Assessment

The business impact of CVE-2026-43670 is moderate to high, depending on the affected environment. The vulnerability undermines a primary defense-in-depth control (CSP) that enterprises rely on to mitigate XSS and data exfiltration risks in web applications. For enterprise users on macOS, a successful exploit could lead to compromise of corporate web sessions, access to internal web applications, and potential lateral movement if the browser session has access to sensitive internal systems.

The affected systems include all iPhones, iPads, and Macs running unpatched versions of iOS, iPadOS, and macOS. Given the widespread adoption of Apple devices in enterprise environments, the blast radius is significant. Safari is the default browser on these platforms, and WebKit is also the rendering engine for many third-party iOS browsers (though App Store policies require using WebKit, making all iOS browsers equally affected).

No CVSS score or vector has been assigned by the vendor or NVD, making precise severity ranking unavailable. However, based on the vulnerability class and the fact that it affects client-side web content processing, it is reasonable to consider this a medium-to-high severity issue. The attack requires user interaction (visiting a malicious page), which lowers the overall risk but does not eliminate it.

Detection Guidance

Sigma Rule

title: Potential CVE-2026-43670 CSP Bypass via AudioWorklet
id: 8f3a2b6c-9d1e-4f0a-b7c8-9a1f2e3d4c5b
status: experimental
description: Detects potential exploitation of CSP bypass in AudioWorklet contexts (CVE-2026-43670) by identifying AudioWorklet module loading activity in web content.
author: Valters IT Security Team
date: 2026/06/01
tags:
    - attack.t1189
    - attack.initial_access
    - cve.2026-43670
logsource:
    category: webserver
    product: webserver
detection:
    selection:
        cs-method: 'GET'
        cs-uri-extension: 'worklet'
        cs-uri-query|contains:
            - 'AudioWorklet'
            - 'worklet.addModule'
            - 'audioWorklet'
    condition: selection
falsepositives:
    - Legitimate websites using AudioWorklet for audio processing
level: medium

YARA Rule

rule CVE_2026_43670_WebKit_CSP_Bypass_AudioWorklet
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects obfuscated or suspicious AudioWorklet usage patterns associated with CVE-2026-43670"
        date = "2026-06-01"
        reference = "CVE-2026-43670"
        severity = "high"

    strings:
        $a1 = "AudioWorklet" ascii wide nocase
        $a2 = "addModule" ascii wide nocase
        $a3 = "Content-Security-Policy" ascii wide nocase
        $a4 = "audioWorklet" ascii wide nocase

        // Script patterns often used in XSS payloads
        $b1 = "eval(" ascii wide
        $b2 = "document.cookie" ascii wide
        $b3 = "fetch(" ascii wide
        $b4 = "XMLHttpRequest" ascii wide

    condition:
        (uint16(0) == 0x3C3F or uint16(0) == 0x3C68 or uint16(0) == 0x3C21)  // <?, <h, <!
        and 2 of ($a*) and 1 of ($b*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-43670 - Potential WebKit CSP Bypass via AudioWorklet"; flow:established,to_client; content:"audioWorklet"; nocase; http_server_body; content:"addModule"; distance:0; nocase; http_server_body; content:"blob:"; distance:0; nocase; http_server_body; classtype:attempted-user; sid:2026436; rev:1; metadata:created_at 2026_06_01, updated_at 2026_06_01;)

Elastic Detection

// Elastic EQL query to detect HTTP responses containing AudioWorklet and CSP
sequence by process.entity_id
  [network where
    network.protocol == "http" and
    process.name == "Safari" or process.name == "WebKit" or process.name == "com.apple.WebKit.WebContent" and
    http.response.body contains "audioWorklet" and
    http.response.body contains "addModule" and
    http.response.body contains "Content-Security-Policy"
  ]

Splunk SPL Query

index=proxy OR index=web
| search (uri="*audioWorklet*" OR uri="*addModule*") 
| search response_body="*Content-Security-Policy*"
| stats count by src_ip, dest_ip, uri, user_agent
| where user_agent LIKE "%Safari%" OR user_agent LIKE "%WebKit%" OR user_agent LIKE "%Macintosh%" OR user_agent LIKE "%iPhone%" OR user_agent LIKE "%iPad%"
| sort -count
| table _time, src_ip, dest_ip, uri, user_agent, count

Wazuh OSSEC Rule

<group name="web_contentdetection,">
  <rule id="100436" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.addModule|audioWorklet</field>
    <match>Content-Security-Policy</match>
    <description>CVE-2026-43670 - Potential WebKit CSP bypass via AudioWorklet detected in web content</description>
    <group>cve_2026_43670,</group>
    <mitre>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — The patch is claimed by a single source (NVD); it is not independently confirmed. Apple has not yet published an independent security advisory at the time of this assessment.

1) Immediate Mitigations:

• Update all Apple devices (iOS, iPadOS, macOS) to the patched versions immediately: Safari 26.5, iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5.
• For managed enterprise devices, push updates via MDM (Jamf, Intune, etc.) with a zero-day urgency policy.
• Until patches are applied, consider blocking access to untrusted or unknown websites on unpatched devices via web filtering/proxy solutions.
• Educate users about phishing risks and avoid clicking links from untrusted sources, as this vulnerability requires user interaction to exploit.

2) Patch/Upgrade Steps:

• For iOS/iPadOS: Navigate to Settings → General → Software Update and install the latest version.
• For macOS: Navigate to System Settings → General → Software Update and install the update.
• For enterprise fleets: Use MDM to force install the updates and track compliance status.
• Validate patch installation on all devices before restoring unrestricted internet access.

3) Long-Term Hardening:

• Verify that all enterprise web applications implement proper CSP headers with strict script-src directives, as this provides defense-in-depth even if WebKit has similar bypasses in the future.
• Regularly audit web security headers across all internal web properties.
• Encourage users to enable Safari's built-in fraud website warnings and ensure that automatic security updates are enabled on all Apple devices.
• Consider implementing browser isolation solutions for high-risk browsing activities on unpatched devices.
• Monitor Apple's security updates page for independent confirmation of this patch.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-43670
2. Apple Security Updates (expected): https://support.apple.com/en-us/HT201222
3. WebKit.org: https://webkit.org/security/
4. CWE-693 (Protection Mechanism Failure): https://cwe.mitre.org/data/definitions/693.html
5. MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/

Threat Actor Campaigns/Exploitation Status: As of the report date, there is no evidence of exploitation in the wild, no public PoC, and no known threat actor campaigns associated with CVE-2026-43670. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The single-source nature of the patch information warrants monitoring for independent confirmation from Apple.