Security brief

Apple credited Big Sleep for five WebKit findings in November 2025 updates

REVIEW

The affected component was WebKit; Google’s AI research agent was credited as a discovery tool.

Published 29 Oct 2026 · Material update 4 Nov 2025 — last time the underlying evidence changed · Evidence: medium

What happened

November 2025 reporting described five WebKit vulnerabilities credited to Google’s Big Sleep research agent. The issues could cause crashes or memory corruption when processing malicious web content.

The listed identifiers were CVE-2025-43429, CVE-2025-43430, CVE-2025-43431, CVE-2025-43433 and CVE-2025-43434. Big Sleep’s role was discovering the issues, not being the affected browser component.

Apple released fixes through relevant platform and Safari updates at the time. Use a currently supported, updated Apple platform and consult Apple’s advisory for device-specific coverage. This retrospective does not assert that all five flaws were exploited in the wild.

Read the original source.

Next step

Apply supported Apple platform and Safari security updates.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references

Technical details

CVE
CVE-2025-43429
CVE
CVE-2025-43430
CVE
CVE-2025-43431
CVE
CVE-2025-43433
CVE
CVE-2025-43434