Attackers are using this December 12, 2025 Critical severity

WebKit flaws used in targeted attacks

A flaw in WebKit, part of macOS. Processing maliciously crafted web content may lead to memory corruption. Apple says these may have been exploited in targeted attacks, and CISA lists them as actively exploited.

On a Mac

Every Mac still on an affected version. The fix comes with the macOS update, and as a Safari update on older macOS versions.

The fix

• macOS 26.2
• Safari 26.2

Attacks

In CISA’s catalog of exploited flaws since December 12, 2025.

CVEs

CVE-2025-14174, CVE-2025-43529

Sources

• support.apple.com
• support.apple.com
• cisa.gov

From the Briefing, updated 20 minutes ago.