CVE-2026-43721 (GCVE-0-2026-43721)

Vulnerability from cvelistv5 – Published: 2026-06-29 19:43 – Updated: 2026-07-27 20:14
VLAI
Summary
This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to silently hijack clipboard data.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • A malicious website may be able to silently hijack clipboard data
  • CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
Impacted products
Vendor Product Version
Apple Safari Affected: 0 , < 26.5.2 (custom)
Create a notification for this product.
Apple iOS and iPadOS Affected: 0 , < 26.5.2 (custom)
Create a notification for this product.
Apple macOS Affected: 0 , < 26.5.2 (custom)
Create a notification for this product.
Apple tvOS Affected: 0 , < 26.6 (custom)
Create a notification for this product.
Apple visionOS Affected: 0 , < 26.6 (custom)
Create a notification for this product.
Apple watchOS Affected: 0 , < 26.6 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-43721",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T20:01:43.924799Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-732",
                "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T20:01:46.573Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.5.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.5.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.5.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "visionOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "26.6",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to silently hijack clipboard data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "A malicious website may be able to silently hijack clipboard data",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T20:14:32.437Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/127594"
        },
        {
          "url": "https://support.apple.com/en-us/127595"
        },
        {
          "url": "https://support.apple.com/en-us/127685"
        },
        {
          "url": "https://support.apple.com/en-us/128068"
        },
        {
          "url": "https://support.apple.com/en-us/128069"
        },
        {
          "url": "https://support.apple.com/en-us/128070"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2026-43721",
    "datePublished": "2026-06-29T19:43:10.464Z",
    "dateReserved": "2026-05-01T22:46:21.645Z",
    "dateUpdated": "2026-07-27T20:14:32.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43721",
      "date": "2026-08-10",
      "epss": "0.00437",
      "percentile": "0.35998"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43721\",\"sourceIdentifier\":\"product-security@apple.com\",\"published\":\"2026-06-29T20:17:36.647\",\"lastModified\":\"2026-07-27T21:16:56.347\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to silently hijack clipboard data.\"}],\"affected\":[{\"source\":\"product-security@apple.com\",\"affectedData\":[{\"vendor\":\"Apple\",\"product\":\"Safari\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.5.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.5.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.5.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.6\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.6\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"26.6\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-30T20:01:43.924799Z\",\"id\":\"CVE-2026-43721\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.5.2\",\"matchCriteriaId\":\"A3C31705-98A5-4EB4-9C89-47140142B078\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.5.2\",\"matchCriteriaId\":\"DB0D3014-6223-4BE5-B8D5-C8A17326859D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.5.2\",\"matchCriteriaId\":\"237EDA63-32B7-40AA-8EDD-726EC67EAE38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"26.0\",\"versionEndExcluding\":\"26.5.2\",\"matchCriteriaId\":\"C3D2FD83-D448-4CD3-90ED-9FB8BF55B0D0\"}]}]}],\"references\":[{\"url\":\"https://support.apple.com/en-us/127594\",\"source\":\"product-security@apple.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/127595\",\"source\":\"product-security@apple.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/127685\",\"source\":\"product-security@apple.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://support.apple.com/en-us/128068\",\"source\":\"product-security@apple.com\"},{\"url\":\"https://support.apple.com/en-us/128069\",\"source\":\"product-security@apple.com\"},{\"url\":\"https://support.apple.com/en-us/128070\",\"source\":\"product-security@apple.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-27T21:07:58+00:00",
      "cve": "CVE-2026-43721",
      "id": "CVE-2026-43721",
      "initial_release_date": "2026-07-10T00:00:00+00:00",
      "product_status:fixed": "92",
      "product_status:known_affected": "17",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43721.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-11T00:07:38Z",
      "cve": "CVE-2026-43721",
      "id": "CVE-2026-43721",
      "initial_release_date": "2026-07-17T12:57:47Z",
      "product_status:first_fixed": "36",
      "product_status:known_affected": "72",
      "product_status:recommended": "432",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43721",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43721.json",
      "version": "10"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-43721\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-30T20:01:43.924799Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-732\", \"description\": \"CWE-732 Incorrect Permission Assignment for Critical Resource\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-30T13:04:45.853Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Apple\", \"product\": \"Safari\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.5.2\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"iOS and iPadOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.5.2\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"macOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.5.2\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"tvOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.6\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"visionOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.6\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Apple\", \"product\": \"watchOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"26.6\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://support.apple.com/en-us/127594\"}, {\"url\": \"https://support.apple.com/en-us/127595\"}, {\"url\": \"https://support.apple.com/en-us/127685\"}, {\"url\": \"https://support.apple.com/en-us/128068\"}, {\"url\": \"https://support.apple.com/en-us/128069\"}, {\"url\": \"https://support.apple.com/en-us/128070\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to silently hijack clipboard data.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"A malicious website may be able to silently hijack clipboard data\"}]}], \"providerMetadata\": {\"orgId\": \"286789f9-fbc2-4510-9f9a-43facdede74c\", \"shortName\": \"apple\", \"dateUpdated\": \"2026-07-27T20:14:32.437Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-43721\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-27T20:14:32.437Z\", \"dateReserved\": \"2026-05-01T22:46:21.645Z\", \"assignerOrgId\": \"286789f9-fbc2-4510-9f9a-43facdede74c\", \"datePublished\": \"2026-06-29T19:43:10.464Z\", \"assignerShortName\": \"apple\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}