Apple released multiple rounds of emergency security updates across iOS, iPadOS, macOS, Safari, and its broader platform ecosystem to address two (2) actively exploited WebKit zero-day vulnerabilities that were leveraged in what the company described as “extremely sophisticated” attacks targeting specific individuals running versions of iOS prior to iOS 26. The flaws, tracked as CVE-2025-43529 and CVE-2025-14174, stemming from a use-after-free remote code execution (RCE) issue and a high-severity memory corruption vulnerability, can both be triggered via maliciously crafted web content and affect all Apple platforms that rely on WebKit, including third-party browsers on iOS and iPadOS. Apple credited its Security Engineering and Architecture team alongside Google’s Threat Intelligence Group (GTIG) for discovering the issues, and confirmed that CVE-2025-14174 was the same previously undisclosed Chrome zero-day Google patched in December, identifying it as an out-of-bounds memory access flaw in the shared ANGLE graphics library (evidence of coordinated disclosure and remediation between the two (2) companies). Google, Microsoft, and other Chromium-based browser vendors subsequently issued fixes, reflecting the cross-ecosystem impact of the vulnerability. Although Apple has not released technical details on the attacks, the narrow targeting, WebKit exploitation, and reuse across mobile and desktop platforms strongly align with known commercial spyware tradecraft, and these fixes bring Apple’s total number of zero-days exploited in the wild in 2025 to at least nine (9), reinforcing the need for rapid patch adoption across all supported devices. CTIX analysts urge any affected readers to ensure they are running the latest update to prevent exploitation.