CVE-2025-43529

Apple WebKit Use-After-Free Exploitation Attempt (CVE-2025-43529)

Initial Access Execution Privilege Escalation Last updated:

Detects exploitation attempts targeting CVE-2025-43529, a use-after-free vulnerability in Apple's WebKit browser engine affecting multiple Apple products. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to arbitrary code execution when a user visits a maliciously crafted webpage. Attackers may leverage this flaw to achieve initial access or privilege escalation on macOS, iOS, and iPadOS devices.

Vulnerability Intelligence

KEV — Known Exploited

Affected Software

Vendor
Apple
Product
Multiple Products

Weakness (CWE)

CWE-416

Timeline

Disclosed
December 15, 2025

CVSS

8.8
High (7.0–8.9)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Write-up coming soon

What is CVE-2025-43529 Apple WebKit Use-After-Free Exploitation Attempt (CVE-2025-43529)?

Apple WebKit Use-After-Free Exploitation Attempt (CVE-2025-43529) (CVE-2025-43529) maps to the Initial Access and Execution and Privilege Escalation tactics — the adversary is trying to get into your network in MITRE ATT&CK.

This page provides production-ready detection logic for Apple WebKit Use-After-Free Exploitation Attempt (CVE-2025-43529), covering the data sources and telemetry it touches: Microsoft Defender for Endpoint, Microsoft Sentinel. The queries below are rated critical severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Initial Access Execution Privilege Escalation
Microsoft Sentinel / Defender
kusto 
union DeviceProcessEvents, DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("Safari", "WebKit", "com.apple.WebKit", "WebProcess", "com.apple.WebKit.WebContent")
| where ActionType in ("ProcessCreated", "NetworkConnectionEvents") or FileName in~ ("WebProcess", "com.apple.WebKit.Networking")
| extend SuspiciousChild = iff(
    InitiatingProcessFileName in~ ("Safari", "WebProcess") and
    FileName in~ ("sh", "bash", "zsh", "python3", "curl", "osascript", "launchctl"),
    true, false)
| where SuspiciousChild == true
| project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RemoteIP, RemoteUrl
| summarize count(), make_set(ProcessCommandLine), make_set(RemoteIP) by DeviceId, DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)

Detects WebKit/Safari spawning suspicious child processes that are indicative of post-exploitation activity following a use-after-free vulnerability trigger. Looks for browser processes launching shells, scripting interpreters, or network utilities.

critical severity high confidence

Data Sources

Microsoft Defender for Endpoint Microsoft Sentinel

Required Tables

DeviceProcessEvents DeviceNetworkEvents

False Positives

  • Legitimate browser extensions invoking shell helpers in sandboxed environments
  • Developer tools or test harnesses running automated browser tests
  • macOS software update processes triggered through browser UI
  • Security scanning tools that spawn child processes from browser contexts

Sigma rule & cross-platform mapping

The detection logic for Apple WebKit Use-After-Free Exploitation Attempt (CVE-2025-43529) (CVE-2025-43529) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2025-43529 Sigma rules on detection.fyi

Platform-specific guides for CVE-2025-43529

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-06-19 Research depth: standard
References (6)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate WebKit Child Process Spawn (macOS)

    Expected signal: Process creation event: parent=osascript, child=bash; bash executing id and whoami commands

  2. Test 2WebProcess Curl Outbound Simulation

    Expected signal: Network connection event: process=curl, initiated from simulated WebKit parent context, destination=127.0.0.1:9999

  3. Test 3Launchctl Persistence Attempt Post-WebKit Exploitation

    Expected signal: Process creation: launchctl load with plist argument; file write to /tmp/webkit_test/test.plist; LaunchAgent registration event in macOS Unified Log

Response Playbook

Triage

  1. Confirm the affected device is an Apple macOS, iOS, or iPadOS system running a vulnerable version of Safari/WebKit prior to Apple's December 2025 patch.
  2. Review the process tree on the affected endpoint to identify whether Safari or a WebKit subprocess (WebProcess, com.apple.WebKit.WebContent) spawned unexpected child processes such as shells, curl, or osascript.
  3. Check browser history and network logs for the timeframe around the alert to identify the URL or domain that may have served the malicious page exploiting CVE-2025-43529.
  4. Determine if the suspicious child process made outbound network connections to unknown or suspicious external IPs or domains that could indicate C2 communication.
  5. Assess whether any files were written to disk by the spawned child process, particularly in /tmp, ~/Library, or ~/Downloads directories.

Containment

  1. Immediately isolate the affected endpoint from the network using MDM (Jamf, Mosyle) or EDR network isolation to prevent potential lateral movement or data exfiltration.
  2. Force-kill all WebKit/Safari processes on the affected device and block access to the identified malicious URL at the proxy, DNS, or firewall level.
  3. Revoke any tokens, credentials, or cookies that may have been accessible to the browser process at the time of exploitation.

Evidence Collection

  1. Capture a full memory dump or volatile data snapshot from the affected macOS endpoint using tools such as osxpmem or CrowdStrike's real-time response before remediation.
  2. Collect macOS Unified Logs (log show --predicate) for the WebKit and Safari subsystems covering the incident window, along with any crash reports in ~/Library/Logs/DiagnosticReports/ that may contain stack traces related to the use-after-free.
  3. Export browser history, extension list, and downloaded file metadata from the affected user profile for forensic analysis.

Escalation Criteria

  • ! Escalate immediately if the spawned child process established a persistent backdoor (launchd plist, login item, or cron job) or performed credential harvesting activity.
  • ! Escalate to incident response if multiple endpoints in the environment show similar WebKit exploitation indicators, suggesting a targeted campaign or watering-hole attack leveraging CVE-2025-43529.

Investigation Guide

Forensic Artifacts

  • > macOS Unified Log entries from subsystem com.apple.WebKit showing crash or memory violation events near the incident timestamp
  • > Crash reports in ~/Library/Logs/DiagnosticReports/ with process name WebProcess or com.apple.WebKit.WebContent containing SIGSEGV or SIGABRT signals
  • > Safari history database at ~/Library/Safari/History.db containing the URL of the malicious page visited
  • > Process creation audit events showing WebProcess as parent of an unexpected shell or interpreter child
  • > Network connection logs showing outbound connections from WebProcess or its child to external IPs

Tuning Guidance

Reduce false positives by adding allowlisting for known-good parent-child pairs in your organization: for example, if Selenium Grid nodes run macOS, exclude those hosts by hostname or device tag. Similarly, if your org uses browser-based osascript automation for MDM workflows, capture those specific command-line patterns and add them as exceptions. Increase confidence by correlating child process spawn alerts with concurrent outbound network connections to non-Apple IPs from the same WebKit process, which strongly indicates exploitation rather than legitimate automation. Consider tuning severity to 'high' rather than 'critical' in dev/QA environments where browser automation is common.

Hunting Queries

30-day retrospective hunt for WebKit browser processes that spawned unexpected shell or scripting child processes, which may indicate historic exploitation of CVE-2025-43529 or similar WebKit vulnerabilities before detection rules were deployed.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName in~ ("WebProcess", "com.apple.WebKit.WebContent", "Safari")
| where FileName in~ ("sh", "bash", "zsh", "python3", "curl", "osascript", "launchctl", "nc")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc
Hunting — SPL
spl 
index=* sourcetype IN ("macos:unified_log", "crowdstrike:events") earliest=-30d
(parent_process_name="WebProcess" OR parent_process_name="Safari" OR parent_process_name="com.apple.WebKit.WebContent")
process_name IN ("sh", "bash", "zsh", "python3", "curl", "osascript", "launchctl", "nc")
| table _time src_host parent_process_name process_name cmdline

Atomic Red Team Tests

Test 1 Simulate WebKit Child Process Spawn (macOS)
macos

Simulates the post-exploitation behavior of CVE-2025-43529 by launching a shell child process under a process named to mimic WebProcess, replicating the process tree pattern that detection rules target.

Command

bash 
osascript -e 'do shell script "bash -c \"sleep 1 && id && whoami\""' & disown

Cleanup

bash 
killall osascript 2>/dev/null; killall bash 2>/dev/null

Expected Telemetry

Process creation event: parent=osascript, child=bash; bash executing id and whoami commands

Expected Detection

Alert on osascript or bash spawned as child of a browser-like parent process; triggered by SPL, CQL, and EQL rules monitoring for suspicious child processes

Test 2 WebProcess Curl Outbound Simulation
macos

Simulates the post-exploitation network callback behavior that would follow a successful CVE-2025-43529 exploit, where the attacker uses the WebKit process context to beacon to a C2 server.

Command

bash 
curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:9999/beacon --max-time 5 || true

Cleanup

bash 
true

Expected Telemetry

Network connection event: process=curl, initiated from simulated WebKit parent context, destination=127.0.0.1:9999

Expected Detection

Alert on curl spawned as child of Safari/WebProcess parent, with outbound network connection to non-Apple destination; triggered by KQL and CQL detections

Test 3 Launchctl Persistence Attempt Post-WebKit Exploitation
macos

Simulates an attacker achieving persistence on a macOS device after exploiting CVE-2025-43529 by loading a LaunchAgent plist via launchctl from within a WebKit child process context.

Command

bash 
mkdir -p /tmp/webkit_test && cat > /tmp/webkit_test/test.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict><key>Label</key><string>com.test.webkit</string><key>ProgramArguments</key><array><string>/bin/sh</string><string>-c</string><string>echo test</string></array></dict></plist>
EOF
launchctl load /tmp/webkit_test/test.plist 2>/dev/null || true

Cleanup

bash 
launchctl unload /tmp/webkit_test/test.plist 2>/dev/null; rm -rf /tmp/webkit_test

Expected Telemetry

Process creation: launchctl load with plist argument; file write to /tmp/webkit_test/test.plist; LaunchAgent registration event in macOS Unified Log

Expected Detection

Alert on launchctl spawned as child of WebKit-related parent process with 'load' argument; indicative of persistence establishment following browser exploitation

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0004Privilege Escalation

Related Techniques

T1189Drive-by CompromiseT1203Exploitation for Client ExecutionT1068Exploitation for Privilege Escalation

Same Tactic: Initial Access

Popular Detections