Apple has shipped iOS 26.2 and iPadOS 26.2 with security updates it says are especially important for users who may be targeted. In its December 12, 2025 release notes, Apple says two WebKit vulnerabilities may have been exploited in “extremely sophisticated attacks” against specific individuals running versions of iOS earlier than iOS 26.
The first issue, CVE-2025-43529, is a WebKit use-after-free vulnerability that could enable arbitrary code execution when processing maliciously crafted web content. Apple says it mitigated the issue with improved memory management and credits Google Threat Analysis Group. The second, CVE-2025-14174, is described as a WebKit memory corruption bug that could also be triggered through crafted web content; Apple says it addressed the flaw with improved validation and credits both Apple and Google Threat Analysis Group.
Apple says iOS 26.2 applies to iPhone 11 and later, and iPadOS 26.2 spans a wide set of iPad models. Beyond the exploited WebKit items, the notes include fixes that touch on privacy and authentication-related risk, including a Photos issue where content in the Hidden Photos Album could be viewed without authentication, plus additional patches across other system components.
For mobile-focused security teams, the update is a reminder that browser and in-app web content remains a high-leverage entry point on smartphones. With WebKit used broadly across Apple platforms, organizations often prioritize rapid rollout for higher-risk user groups when Apple signals active exploitation.
Sources: Apple
—
By the Mobile ID World Editorial Team
