erroneo.us
Search all guides⌘K

Security Digest · Dec 12, 2025 · Vulnerability · Mobile

Apple WebKit CVE-2025-43529: Zero-Day in the DarkSword Chain

WebKit use-after-free used in the DarkSword iOS 18 exploit chain. Fixed in iOS 26.2, iOS 18.7.3, macOS Tahoe 26.2 and Safari 26.2. Find devices that missed it.

Published By erroneo.us Security Desk · Updated 3 min read12 sources

Our verdict

Check exposure

Fixed ten months ago and installed on most devices by now, but iPhones on iOS 18 below 18.7.3 still carry a browser bug that spyware vendors and a Russian espionage group used in the DarkSword chain.

Who must act: Anyone with iPhones or iPads on iOS/iPadOS 18 below 18.7.3 or 26 below 26.2, Macs with Safari below 26.2, or Linux apps on WebKitGTK or WPE WebKit below 2.50.4, most urgently for people likely to be targeted.

Who can relax: Devices on iOS/iPadOS 18.7.3 or later, 26.2 or later or 27.x, and Macs on Tahoe 26.2 or later or with Safari 26.2 or later, where DarkSword's browser exploit and sandbox escape are fixed.

Affected
iOS and iPadOS 26 before 26.2
iOS and iPadOS 18 before 18.7.3
macOS Tahoe before 26.2
Safari before 26.2 on macOS Sonoma and Sequoia
tvOS, watchOS and visionOS before 26.2
WebKitGTK and WPE WebKit before 2.50.4
Fixed in
iOS and iPadOS 26.2
iOS and iPadOS 18.7.3
macOS Tahoe 26.2
Safari 26.2
tvOS 26.2, watchOS 26.2, visionOS 26.2
WebKitGTK and WPE WebKit 2.50.4
CVSS
8.8 (v3.1, CISA-ADP)
EPSS
8.8% (percentile 95)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Pull an OS version report from MDM and flag iPhones and iPads on iOS 18 below 18.7.3 or iOS 26 below 26.2.
  2. Check Macs with sw_vers -productVersion and the Safari version; flag Tahoe below 26.2 and Sonoma or Sequoia Macs with Safari below 26.2.
  3. Update to the newest build each device supports (iOS 26.3 or later also fixes DarkSword's dyld bypass, CVE-2026-20700) and enforce a minimum OS version in MDM.
  4. On Linux, update WebKitGTK or WPE WebKit to 2.50.4 or later.
  5. For high-risk users and any device that cannot update, turn on Lockdown Mode, as Google recommends.

How to check if you are affected or compromised

  • Search DNS and proxy logs for the DarkSword domains Google published: snapshare[.]chat, sahibndn[.]io, e5.malaymoil[.]com, static.cdncounter[.]net and sqwas.shapelie[.]com.
  • Check firewall logs for the GHOSTKNIFE C2 addresses 62.72.21[.]10 and 72.60.98[.]48.
  • Do not treat clean crash logs as reassurance: Google says GHOSTKNIFE and GHOSTBLADE delete crash reports.
  • If a device on an affected build reached any indicator, get a professional mobile forensics review and treat its accounts and messages as exposed.

What happened#

On December 12, 2025, Apple released iOS 26.2, iOS 18.7.3, macOS Tahoe 26.2, Safari 26.2 and matching tvOS, watchOS and visionOS updates. They fix CVE-2025-43529, a use-after-free in WebKit where "processing maliciously crafted web content may lead to arbitrary code execution." The iOS 26.2 note says the bug "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26," and credits Google's Threat Analysis Group. Apple adds that CVE-2025-14174, an ANGLE memory corruption bug that Google had fixed two days earlier in Chrome 143, came from the same report. This brief covers only CVE-2025-43529. CISA added CVE-2025-43529 to the KEV catalog on December 15, and CISA's ADP scores it 8.8 on NVD.

On March 18, 2026, Google's Threat Intelligence Group published its DarkSword report, written with Lookout and iVerify. DarkSword is a six-bug iOS chain for iOS 18.4 through 18.7. CVE-2025-43529 is its JavaScriptCore remote code execution stage on iOS 18.6 and 18.7, paired with a dyld pointer-authentication bypass (CVE-2026-20700, fixed in iOS 26.3), with CVE-2025-14174 as the sandbox escape. Google saw the chain from November 2025 onward with several users. UNC6748 used a Snapchat-themed site against Saudi users. Customers of PARS Defense, a Turkish surveillance vendor, used it in Turkey and Malaysia. UNC6353, a suspected Russian espionage group, put it on compromised Ukrainian sites through March 2026. The payloads steal messages, accounts, location and files.

Who is affected#

Affected: iOS/iPadOS 26 before 26.2, iOS 18 before 18.7.3 (18.7.3 note), macOS Tahoe before 26.2, Safari before 26.2 on Sonoma and Sequoia, and tvOS, watchOS and visionOS before 26.2. WebKitGTK and WPE WebKit before 2.50.4 are also affected (WSA-2025-0010). Apple lists no fix for iOS 15 or 16, and whether those versions are affected is not disclosed as of Oct 23, 2026.

Do you really need to act?#

For devices that auto-update, no. Apple's current builds are iOS 26.7.1 and 27.0.1, with iOS 18.7.10 for the iPhone XS and XR. The concern is the iPhone that stayed on an early iOS 18 build. DarkSword passed from vendor to vendor and into a watering-hole campaign, so the exposure is no longer limited to a handful of hand-picked targets.

What to do now#

  1. Pull an MDM version report. Flag iOS 18 below 18.7.3 and iOS 26 below 26.2.
  2. On Macs, run sw_vers -productVersion and defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString.
  3. Update to the newest build each device supports. Builds from iOS 26.3 on also fix the dyld bypass. Then enforce a minimum OS version in MDM.
  4. On Linux, run dpkg -l | grep -i webkit or rpm -qa | grep -i webkit and update below 2.50.4.
  5. Turn on Lockdown Mode for high-risk users and devices that cannot update, as Google recommends.

How to tell if you were hit#

Google publishes DarkSword indicators. Search DNS and proxy logs: grep -E "snapshare\.chat|sahibndn\.io|malaymoil\.com|cdncounter\.net|shapelie\.com" dns.log. Check firewall logs for 62.72.21.10 and 72.60.98.48, the GHOSTKNIFE C2 servers. Do not take a clean crash log as reassurance, because Google says GHOSTKNIFE and GHOSTBLADE delete crash reports. If a device on an affected build touched any indicator, get a professional mobile forensics review and treat its accounts and messages as exposed.

Timeline#

  • — Apple ships iOS 26.2, iOS 18.7.3, macOS Tahoe 26.2 and Safari 26.2.
  • — CISA adds CVE-2025-43529 to KEV, with a January 5, 2026 deadline.
  • — WebKitGTK and WPE publish WSA-2025-0010.
  • — Google publishes the DarkSword report.

Vulnerability records

  • CVE-2025-43529 · KEV 2025-12-15 · A use-after-free issue was addressed with improved memory management.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Apple — About the security content of iOS 26.2 and iPadOS 26.2 support.apple.com
  2. Apple — About the security content of iOS 18.7.3 and iPadOS 18.7.3 support.apple.com
  3. Apple — About the security content of macOS Tahoe 26.2 support.apple.com
  4. Apple — About the security content of Safari 26.2 support.apple.com
  5. Apple — Apple security releases support.apple.com
  6. CVE record — CVE-2025-43529 cve.org
  7. NVD — CVE-2025-43529 nvd.nist.gov
  8. CISA — Known Exploited Vulnerabilities: CVE-2025-43529 cisa.gov
  9. WebKitGTK — Security Advisory WSA-2025-0010 webkitgtk.org
  10. CVE record — CVE-2025-14174 (ANGLE, companion bug) cve.org
  11. Google Threat Intelligence Group — The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors cloud.google.com
  12. Google — Chrome stable channel update for desktop (December 10, 2025) chromereleases.googleblog.com