Apple has rolled out iOS 26.5.2, a maintenance update that closes 29 security vulnerabilities across the iPhone and iPad software. Attention right now is mostly on the iOS 27 beta, but Apple is still actively patching the current iOS 26 line, and this particular release stands out for one reason: it wasn't supposed to arrive yet.
Why Apple moved up the release
Apple has said that iOS 26.5.2 was actually intended for a future version of iOS, likely iOS 26.6, before being pushed out ahead of schedule. The reason comes down to the growing capability of new AI models, including systems like Anthropic's Claude Mythos, which can spot security flaws in software far faster than human researchers ever could.
That speed cuts both ways. If AI models can discover vulnerabilities quickly, so can the people trying to exploit them. Apple has traditionally bundled its security patches together with regular feature updates rather than shipping them separately, a strategy followed by some other companies. But with AI tools making it easier for bad actors to find and weaponize flaws, Apple says it will now release security patches much sooner than it used to, instead of waiting to fold them into the next scheduled update.
This is a notable departure from how Apple has historically operated. For years, the company has preferred to fold security fixes into its regular update cycle rather than issuing a constant stream of standalone patches, unlike some other software makers that separate security releases from feature releases entirely. That approach worked when the biggest risk to unpatched software was a determined human researcher or attacker working alone. AI changes that calculus, since a capable model can scan code and flag exploitable weaknesses at a scale and speed no individual team could match.
Practically speaking, iPhone and iPad users should expect more frequent software updates going forward. It wouldn't be surprising to see iOS 26.5.3 land before iOS 26.6 even ships, and there could be more incremental iOS 26 releases than usual before iOS 27 arrives this fall. Given how quickly AI tools can now surface exploitable flaws, installing every update as soon as it's available is more important than it has ever been.
What the 29 fixes actually address
None of the 29 vulnerabilities patched in iOS 26.5.2 qualifies as a zero-day. A zero-day is a flaw that becomes publicly known or gets actively exploited before the software's developer has any chance to fix it, which is what makes zero-days so dangerous: attackers effectively get a running start, free to search for or abuse the weakness for as long as it takes the developer to ship a patch and for the wider user base to actually install it. Because none of the flaws fixed here fall into that category, there's no indication that anyone was exploiting them in the wild before Apple issued this update.
That said, an unpatched flaw is still a real risk, and once details of a vulnerability become public, as they now have with this release, it's only a matter of time before someone works out how to exploit it, particularly with AI models available to speed up that research. That's the core reason Apple is urging users to install iOS 26.5.2 without delay.
Per Apple's official security release notes, iOS 26.5.2 together with iPadOS 26.5.2 patches 29 separate flaws. The bulk of them sit inside WebKit, the engine that powers Safari and governs how the browser handles and protects user data while rendering web pages. Several of the WebKit flaws could expose sensitive data if a user processes malicious web content, such as clicking a fraudulent link, while one vulnerability could leak sensitive data simply by visiting a website, even a site that isn't itself malicious. Another patch closes a hole that would have allowed a malicious website to process restricted content outside the sandbox, the secure boundary Apple maintains around websites specifically so they cannot reach into protected areas of iOS. Yet another addresses a flaw that could have let a website silently hijack a user's clipboard data without any visible warning.
Beyond WebKit, the update also covers flaws in the kernel, the IOGPUFamily graphics component, the libxslt processing library, Web Extensions, WebRTC, and WebKit's Canvas and Storage subsystems. Several of the kernel-level issues could let a malicious app force an unexpected system shutdown, leak sensitive kernel state, or in some cases corrupt kernel memory outright, all fixed through tighter input validation and sanitization.
The full list of vulnerabilities patched
Apple's release notes break down all 29 fixes by component, with a description of the risk, how it was addressed, and the CVE (Common Vulnerabilities and Exposures) tracking number for each. As noted, none of them currently has a known active exploit.
- IOGPUFamily: An app may be able to cause unexpected system termination. A race condition was addressed with improved state handling. CVE-2026-43743.
- Kernel: An app may be able to cause unexpected system termination or write kernel memory. The issue was addressed with improved input sanitization. CVE-2026-43724.
- Kernel: An app may be able to leak sensitive kernel state. The issue was addressed with improved input sanitization. CVE-2026-43722.
- Kernel: An app may be able to cause unexpected system termination or corrupt kernel memory. This issue was addressed with improved input validation. CVE-2026-39868.
- libxslt: Processing maliciously crafted web content may lead to an unexpected process crash. A double free issue was addressed with improved memory management. CVE-2026-43706.
- libxslt: Processing maliciously crafted web content may lead to an unexpected process crash. The issue was addressed with improved memory handling. CVE-2026-43703.
- Web Extensions: A malicious web extension may be able to cause an unexpected process crash. A use-after-free issue was addressed with improved memory management. CVE-2026-43704.
- WebKit: Processing maliciously crafted web content may disclose sensitive user information. A cross-origin issue was addressed with improved tracking of security origins. CVE-2026-43700.
- WebKit: A malicious website may exfiltrate data cross-origin. The issue was addressed with improved checks. CVE-2026-43735.
- WebKit: Processing maliciously crafted web content may lead to an unexpected process crash. A use-after-free issue was addressed with improved memory management. CVE-2026-43734, CVE-2026-43726, CVE-2026-43709, CVE-2026-43699, CVE-2026-43742.
- WebKit: Processing maliciously crafted web content may disclose sensitive user information. A path handling issue was addressed with improved validation. CVE-2026-43732.
- WebKit: Processing maliciously crafted web content may lead to memory corruption. A use-after-free issue was addressed with improved memory management. CVE-2026-43731, CVE-2026-43715.
- WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash. A use-after-free issue was addressed with improved memory management. CVE-2026-43727.
- WebKit: A malicious website may be able to process restricted web content outside the sandbox. The issue was addressed with improved input validation. CVE-2026-43725.
- WebKit: Processing maliciously crafted web content may lead to an unexpected process crash. The issue was addressed with improved memory handling. CVE-2026-43663, CVE-2026-39872, CVE-2026-43712.
- WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash. The issue was addressed with improved memory handling. CVE-2026-43716.
- WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash. An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-43676.
- WebKit: Processing maliciously crafted web content may result in the disclosure of process memory. The issue was addressed with improved memory handling. CVE-2026-43740.
- WebKit: Visiting a website may leak sensitive data. A permissions issue was addressed with additional restrictions. CVE-2026-43713.
- WebKit: A malicious website may exfiltrate data cross-origin. The issue was addressed with improved input validation. CVE-2026-43708.
- WebKit: Processing maliciously crafted web content may lead to an unexpected process crash. A memory corruption issue was addressed with improved memory handling. CVE-2026-43707.
- WebKit: Processing maliciously crafted web content may lead to memory corruption. A type confusion issue was addressed with improved checks. CVE-2026-43705.
- WebKit: A malicious website may be able to process restricted web content outside the sandbox. The issue was addressed with improved checks. CVE-2026-43701.
- WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash. An out-of-bounds write issue was addressed with improved input validation. CVE-2026-43745.
- WebKit Canvas: Processing maliciously crafted web content may lead to an unexpected Safari crash. A use-after-free issue was addressed with improved memory management. CVE-2026-43720.
- WebKit Storage: A malicious website may be able to silently hijack clipboard data. This issue was addressed through improved state management. CVE-2026-43721.
- WebRTC: Processing maliciously crafted web content may lead to an unexpected process crash. An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-28979.
- WebRTC: Processing maliciously crafted web content may lead to an unexpected Safari crash. A stack overflow was addressed with improved input validation. CVE-2026-43718.
- WebRTC: Processing maliciously crafted web content may lead to an unexpected Safari crash. A use-after-free issue was addressed with improved memory management. CVE-2026-43717, CVE-2026-43746.
How to install iOS 26.5.2
Installing iOS 26.5.2 works exactly like any other iOS update. If Automatic Updates is switched on, an iPhone or iPad should install the patch on its own without requiring any action. To trigger it manually, open the Settings app, tap General, then Software Update, and follow the on-screen instructions. The matching update, iPadOS 26.5.2, rolls out through the identical process on iPad.
With Apple signaling that this faster release cadence is here to stay, users who are used to checking for updates only occasionally may want to turn on Automatic Updates or get into the habit of checking Software Update more regularly, at least until the current wave of AI-assisted vulnerability discovery settles down.
