![\"Apple](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2025\/12\/1765705573_969_0x0.jpg\")
<\/p>\n<\/p>\n
Confirmation of iPhone attacks.<\/p>\n
NurPhoto via Getty Images<\/p>\n
Updated on Dec. 13 with additional analysis of the new attack warning.<\/p>\n
Apple has just warned<\/a> that two iPhone vulnerabilities \u201cmay have been exploited in an extremely sophisticated attack against specific targeted individuals.\u201d It follows this month\u2019s spyware<\/a> warnings, issued to iPhone users around the world. <\/p>\n Both vulnerabilities have now been fixed in iOS 26.2<\/a>, released today. But while the update now message applies to users already running iOS 26, there\u2019s a more serious warning for those yet to upgrade. These attacks targeted individuals \u201con versions of iOS before iOS 26.\u201d And even though iOS 18 is still being patched, it\u2019s not worth the risk. <\/p>\n Apple wants you to upgrade. You should do exactly that.Apple has disclosed that the two vulnerabilities are linked. CVE-2025-14174 and CVE-2025-43529 were both \u201cissued in response to this report.\u201d One is attributed to Google\u2019s Threat Analysis Group, the other to Google\u2019s threat hunters and Apple itself. <\/p>\n And both affect WebKit. One, Apple says, risks a browser \u201cprocessing maliciously crafted web content (that) may lead to arbitrary code execution.\u201d While the other \u201cmay lead to memory corruption.\u201d This has the hallmarks of a chained spyware attack.<\/p>\n Forbes\u2018It May Be Worse\u2019\u2014No Fix For New Google Chrome AttacksBy Zak Doffman<\/a><\/p>\n According to Ali Mousavifar from Menlo Security, \u201cthe two active WebKit exploits in iOS 26.2 highlight a clear trend: browser engines are a primary target for attackers. We should expect these types of attacks to continue as the browser becomes the center of modern work. Relying solely on patching is a reactive game.\u201d<\/p>\n \u201cIn all probability, these vulnerabilities have been chained to achieve exploitation,\u201d Mayuresh Dani from Qualys told me. \u201cWebKit has a well-documented history of serving as the primary entry point for sophisticated spyware and surveillance campaigns.\u201d That includes \u201cnow infamous monitoring spywares such as Pegasus, which have consistently relied on WebKit vulnerabilities as its primary attack vector.\u201d<\/p>\n Dani says iPhone users must \u201cfollow operational security practices, such as updating to iOS 26.2 immediately, using iCloud Private Relay to mask their IP and encrypt DNS queries (and) also as a practice, users should enable private browsing and disable JavaScript temporarily while interacting with untrusted sites.\u201d<\/p>\n The two exploited vulnerabilities are amongst eight WebKit threats patched in this release. Others are various types of memory mishandling, which opens the door to destabilizing an app or the OS, potentially allowing other types of exploits to be used. Again, just more reasons to ensure you install the update as soon as it shows available.<\/p>\n We have seen WebKit zero-day attacks<\/a> before. It\u2019s a prime target<\/a> for spyware developers building and marketing exploits. These latest vulnerabilities can be added to the \u201c17 zero-day bugs in WebKit that attackers have exploited in the wild<\/a>\u201d since 2023. And while these are targeted at very specific individuals, vulnerabilities have a nasty habit of getting into the wild and spreading further down the food chain.<\/p>\n \u201cUsers should urgently update all their impacted Apple devices,\u201d James Maude from BeyondTrust warns. \u201cEven though this only appears to be linked to a small number of targeted attacks it will quickly become a must have exploit for a range of threat actors.\u201d<\/p>\n There is a further risk to users beyond the two exploited vulnerabilities, now that iOS 26\u2019s fixes are in the public domain. For example, \u201can app may be able to access sensitive user data\u201d in Messages or \u201cpassword fields may be unintentionally revealed when remotely controlling a device over FaceTime.\u201d <\/p>\n At the beginning of December, Google also warned that its OS was under attack<\/a>. Again it was two vulnerabilities that were being exploited in the wild to target Android users. It rushed out an emergency update within hours and Pixels were patched<\/a> within days. <\/p>\n Dani explains \u201cthe two critical WebKit vulnerabilities are memory safety violations that Apple confirms were weaponized in real-world targeted attacks against specific individuals on pre-iOS 26 devices. CVE-2025-43529 allows threat actors a direct code execution capability, while CVE-2025-14174 provides the much needed sandbox escape and privilege escalation capabilities which makes it devastating.\u201d<\/p>\n The other notable vulnerability beyond WebKit, per Cyber Press<\/a>, is \u201c a critical Kernel issue (CVE-2025-46285) in which a malicious app could gain root privileges due to an integer overflow bug. The fix involves adopting 64-bit timestamps to prevent privilege escalation exploits. Another serious flaw in the App Store (CVE-2025-46288) could have allowed apps to access sensitive payment tokens, exposing financial data; this issue is now fixed with stricter permission controls.\u201d<\/p>\n ForbesSamsung Surprises Millions Of Users With Emergency Android UpdateBy Zak Doffman<\/a><\/p>\n Maude warns \u201cWebKit is the underpinning for every iOS browser and many apps as Apple requires it to be used for apps in their store. Every browser uses the same WebKit rendering engine layering additional functionality layer on top . While this allows them to control the ecosystem, it also creates an inherent point of failure. If Webkit is vulnerable your entire device could be vulnerable when viewing content online.\u201d<\/p>\n This isn\u2019t the first time we\u2019ve seen Android and iPhone attacks disclosed and addressed the same month. Both operating systems are being attacked by the same mercenary spyware industry, so it should be no surprise. Both Apple and Google have done a good job in rushing out fixes to everyone, everywhere. The caveat on the Android side is that this only works for Pixels. Other OEMs \u2014 Samsung for example<\/a> \u2014 cannot do the same.<\/p>\n