This is a Code Red for anyone running the Apple ecosystem. We aren’t looking at your run-of-the-mill performance improvements and bug fixes here. We are looking at two aggressively exploited zero-days that have the fingerprints of advanced mercenary spyware all over them.
When we see Google Threat Analysis Group (TAG) credited with a find, we sit up. When we see them credited alongside Apple’s SEAR team for active exploitation, we start patching before we even finish reading the report.
Here is our deep dive into CVE-2025-14174 and CVE-2025-43529: what they are, how they work, and why you need to kill your old browser sessions immediately.
What is Webkit
To understand why a simple bug in WebKit is a global security emergency, you have to understand what WebKit actually is.
WebKit is the browser engine developed by Apple. It is the piece of software responsible for taking the code of a website (HTML, CSS, JavaScript) and rendering it into the visual page you interact with on your screen.
Think of a web browser (like Safari) as a car.
Safari is the body, the steering wheel, and the dashboardthus it’s the buttons you click and the bookmarks you save.
WebKit is the engine. It does all the heavy lifting.
You can change the paint job or the dashboard (switch from Safari to the Mail app or a 3rd party browser on iOS), but underneath, they are often running the exact same engine.
Why is it a Security Nightmare?
On macOS and especially iOS, WebKit isn’t just used by Safari. It is deeply embedded into the operating system.
When you open a link in Mail, that’s WebKit. When you view a login page in Twitter/X or LinkedIn, that’s WebKit. When you browse the App Store, that is often WebKit rendering the content.
For years, Apple forced every browser on the iPhone (Chrome, Firefox, Edge) to use the WebKit engine instead of their own. Even though this rule is relaxing in the EU due to the Digital Markets Act (DMA), the vast majority of iOS users are still running WebKit-powered browsers.
When a vulnerability like CVE-2025-43529 hits WebKit, it doesn’t just break a single app. It compromises the fundamental layer that the entire Apple ecosystem uses to look at the internet. If you can exploit WebKit, you can hack the device through almost any app that loads a webpage.
I wrote a deeper breakdown here :
👉 https://motasem-notes.net/apple-vulnerability-cve-2025-14174-breakdown-apple-webkit-zero-day-explained/
0 comments