Apple has released iOS 26.2 and iPadOS 26.2, publishing detailed security notes that underscore the urgency of the update for users at heightened risk. The release, dated December 12, 2025, applies to iPhone 11 and later and a wide range of iPads, including recent iPad Pro, iPad Air, iPad, and iPad mini models. At the center of the update are two WebKit vulnerabilities that Apple says may have been exploited in “extremely sophisticated attacks” against specific targeted individuals running versions of iOS prior to iOS 26.
One of the vulnerabilities, CVE-2025-43529, is a use-after-free flaw in WebKit that could allow arbitrary code execution when processing maliciously crafted web content. Apple says it addressed the issue through improved memory management and credits Google Threat Analysis Group for reporting it. The second issue, CVE-2025-14174, is described as a WebKit memory corruption vulnerability that could likewise be triggered via crafted web content. Apple says it fixed the flaw with improved validation and credits both Apple and Google Threat Analysis Group. Apple’s advisory language indicates the two disclosures are linked to the same reporting context, suggesting coordinated analysis of a targeted exploitation chain.
Beyond WebKit, the security notes include fixes with direct privacy and identity implications. Apple addresses a Photos issue where images in the Hidden Photos Album could be viewed without authentication, and lists additional fixes across components including the kernel and calling frameworks that could otherwise enable privilege escalation or spoofing scenarios. Apple also discloses a substantial number of additional WebKit bugs, including type confusion and buffer overflow issues, indicating a broader browser hardening effort alongside the exploited items.
Apple’s phrasing around “extremely sophisticated attacks” and “specific targeted individuals” lines up with patterns seen in high-end spyware and targeted intrusion campaigns. As a result, CISOs are likely to treat this release as a priority update for executive, journalist, and other high-risk user populations, particularly given WebKit’s role as a shared rendering engine across browsers and in-app web views on Apple platforms.
Sources: Apple
—
By Ji-seo Kim
