Apple Issues Security Updates After Two Web Kit Flaws Found Exploited in the Wild
Summary: Apple released security updates for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari on Friday to fix two WebKit flaws it said have been exploited in the wild, one of which Apple says may have been used in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 is the same out-of-bounds memory access in the ANGLE library's Metal renderer that Google patched in Chrome on December 10, 2025, and Apple credited its Security Engineering and Architecture group and Google's Threat Analysis Group with finding it, while crediting TAG with CVE-2025-43529.
Why it matters: Both flaws sit in WebKit, the engine behind every third-party browser on iOS and iPadOS, and the TAG credit points to highly targeted mercenary spyware rather than opportunistic scanning. These are two of nine zero-days Apple has patched as exploited in the wild in 2025, so the patch cadence itself is the exposure.