Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild

Apple released security updates on Friday for iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari to fix two WebKit flaws, CVE-2025-43529 and CVE-2025-14174, that it said have been exploited in the wild. Apple said the flaws "may have been exploited in an extremely sophisticated attack against specific targeted individuals" on versions of iOS before iOS 26. CVE-2025-14174 is the same flaw Google patched in Chrome on December 10, 2025, an out-of-bounds memory access in its ANGLE library's Metal renderer. Apple credited Apple Security Engineering and Architecture (SEAR) and Google Threat Analysis Group (TAG) with the CVE-2025-14174 discovery and credited TAG with CVE-2025-43529. With these updates, Apple has patched nine zero-day vulnerabilities exploited in the wild in 2025.