Apple and Google have issued urgent emergency security updates for their devices and browsers following the discovery of multiple actively exploited "zero-day" vulnerabilities. Users of iPhones, iPads, Macs, Android phones, and the Chrome web browser are urged to install these critical patches immediately to protect against sophisticated attacks already underway. The flaws could allow attackers to execute malicious code, access sensitive data, or escalate privileges on affected systems. ### Critical Flaws Prompt Urgent Apple Patches Apple released emergency updates on December 12, 2025, for various operating systems, including iOS 26.2, iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, watchOS 26.2, and visionOS 26.2, as well as Safari 26.2.^[1] These updates address two critical WebKit zero-day vulnerabilities, identified as CVE-2025-43529 and CVE-2025-14174.^[1][2] WebKit is the browser engine powering Safari and all web browsers on iOS. CVE-2025-43529 is a use-after-free flaw in WebKit that could lead to remote code execution when processing maliciously crafted web content.^[1] This means simply visiting a compromised website could allow attackers to take control of a device. The second vulnerability, CVE-2025-14174, is a WebKit memory corruption flaw.^[1] This flaw could also lead to arbitrary code execution or memory corruption.^[3] Both vulnerabilities were reportedly exploited in "extremely sophisticated attacks" targeting specific individuals using iOS versions older than iOS 26.^[1][2] Google's Threat Analysis Group (TAG) discovered CVE-2025-43529, while CVE-2025-14174 was found by both Apple and Google's TAG, indicating a coordinated effort or related exploits.^[1][2] James Maude, a security expert from BeyondTrust, emphasized the urgency, stating, "Users should urgently update all their impacted Apple devices."^[2] He warned that even if initially targeted, these exploits could quickly spread.^[2] ### Google Devices Also Targeted by Exploits Google also moved quickly to address its own set of actively exploited zero-day vulnerabilities in both its Android operating system and the Chrome web browser. On December 10-11, 2025, Google issued emergency updates for Chrome, marking the eighth such zero-day patched this year.^[3][4] The Chrome vulnerability, initially tracked as issue 466192044 and later confirmed as CVE-2025-14174, is an out-of-bounds memory access flaw in the LibANGLE library's Metal renderer.^[3][1][5] This Chrome vulnerability could result in memory corruption, crashes, sensitive information leaks, or arbitrary code execution through a maliciously crafted HTML page.^[3][6][7] The patches rolled out to Windows (version 143.0.7499.109), macOS (version 143.0.7499.110), Linux (version 143.0.7499.109), ChromeOS (version 16433.65.0), and Chrome for Android (version 143.0.7499.109).^[3][4] Google is currently withholding technical details about the exploit to prevent further attacks while users update.^[3][4] The fact that CVE-2025-14174 was also patched by Apple suggests a shared underlying component or a coordinated attack across platforms.^[1] For Android users, Google released critical security patches in its December 2025 Android Security Bulletin.^[8][9] These updates address two high-severity zero-day vulnerabilities, CVE-2025-48633 and CVE-2025-48572.^[10][9] Both flaws affect the core Android framework. CVE-2025-48633 could lead to information disclosure, while CVE-2025-48572 allows for privilege escalation.^[10][9] Google confirmed that these vulnerabilities "may be under limited, targeted exploitation."^[10][9] The December updates are available for Android 13, 14, 15, and 16, with security patch levels dated December 5, 2025, or later.^[11][9] ### Why Immediate Updates Are Crucial A "zero-day" vulnerability is a software flaw that hackers discover and exploit before the vendor knows about it or can release a fix. This makes them extremely dangerous because there are no existing defenses against attacks. Once a patch is released, attackers often reverse-engineer the fix to understand the vulnerability and develop widespread exploits, making unpatched devices prime targets. Security experts consistently advise users to update their devices as soon as emergency patches become available. Delaying updates leaves devices vulnerable to attacks that can compromise personal data, financial information, and overall system security. These recent exploits highlight the continuous threat posed by sophisticated cybercriminals and state-sponsored actors who actively seek out and weaponize such flaws. ### What Happens Next Both Apple and Google will continue to monitor the threat landscape. While they typically withhold technical details of zero-day exploits initially to protect users, more information may become public once a majority of users have updated their devices. Users should ensure their devices are set to receive automatic updates or manually check for and install the latest software versions. Keeping all software, including operating systems, browsers, and applications, up to date is the most effective way to defend against these evolving cyber threats. Users should prioritize installing these emergency updates to safeguard their digital lives from ongoing and future exploitation attempts.

AI Insights Hub