Apple’s November 2025 patch wave: 110 fixes across iOS, macOS, watchOS, tvOS, visionOS, Safari, and Xcode

Apple shipped coordinated security updates on November 3, 2025 for iOS/iPadOS 26.1, macOS Tahoe 26.1, watchOS 26.1, tvOS 26.1, visionOS 26.1, Safari 26.1, and Xcode 26.1. The Internet Storm Center counted 110 vulnerabilities across the set, with no CVEs marked as exploited in the wild by Apple at publication time. (support.apple.com)

Intrusion Flow

This is a likely attacker flow derived from Apple’s release notes and ISC’s summary; use it to guide triage and hypothesis testing.

1. Initial access via browser content

• Multiple WebKit issues allow code execution paths or process crashes when processing crafted web content. Expect delivery via malicious sites, ads, or embedded views. (support.apple.com)

2. Sandbox escape and policy bypass

• Apple tightened several sandbox and data-access controls in this release (e.g., AppleMobileFileIntegrity, Sandbox, Sandbox Profiles, and TCC). These fixes indicate realistic post-renderer breakout and entitlements abuse were in scope for attackers. (support.apple.com)
• ISC explicitly flags a TCC item (CVE-2025-43412) in the rollup, reinforcing the policy-bypass theme. (isc.sans.edu)

3. Persistence and execution control on macOS

• Finder/Gatekeeper: a Finder issue allowed bypassing Gatekeeper checks (CVE-2025-43348), which could affect quarantine/Gatekeeper-based trust decisions on downloaded content. (support.apple.com)
• Quarantine underpins Gatekeeper decisions; Apple documents the quarantine xattr and its relationship to Gatekeeper behavior. (developer.apple.com)

4. Data access and collection

• Numerous components with data-access impacts were fixed (Contacts, Photos, FileProvider, Notes, Security, PackageKit, and more). Expect prior chains to pivot into sensitive data via these services if earlier stages succeeded. (support.apple.com)

5. Media-driven code paths

• Beyond WebKit, multiple media parsers were patched. In particular, ImageIO and FontParser memory-corruption items were called out by ISC, and Apple lists additional media parsers (Model I/O, CoreText, sips) affected this cycle. Treat untrusted media as a viable initial vector. (isc.sans.edu)

Key Artifacts to Pull

macOS (Tahoe 26.1)

• Gatekeeper/quarantine indicators:
  • Extended attributes on suspicious downloads (kMDItemWhereFroms and com.apple.quarantine). Commands:

    xattr -l /path/to/file
    mdls -name kMDItemWhereFroms /path/to/file
    

    Apple references quarantine in developer guidance and forums; use it to validate provenance and user-consent pathways. (developer.apple.com)
• TCC decisions and changes:
  • TCC database: /Library/Application Support/com.apple.TCC/TCC.db and the per-user equivalent; inspect for recent grants affecting Camera, Microphone, ScreenCapture, Full Disk Access, etc. (requires proper authorization). (cisa.gov)
  • Unified Logs for TCC evaluation (investigative aid from Apple’s PPPC doc):

    log stream --debug --predicate 'subsystem == "com.apple.TCC" AND eventMessage BEGINSWITH "AttributionChain"'
    

    (support.apple.com)
• Safari/WebKit activity:
  • History and cache for drive-by activity: ~/Library/Safari/History.db and ~/Library/Caches/com.apple.Safari/. (forensics.wiki)
• Evidence of Gatekeeper bypass attempts:
  • Cross-check Finder/Gatekeeper CVE-2025-43348 with file quarantine state and symlink handling noted in Apple’s notes; correlate with user execution flow. (support.apple.com)
• Media-parsing triggers:
  • Look for crashes or abnormal invocations of sips, Model I/O, CoreText-consuming processes around first-observed compromise. (support.apple.com)

iOS/iPadOS (26.1)

• WebKit exploitation traces and privacy/policy changes:
  • Multiple WebKit CVEs; one explicitly mentions potential keystroke monitoring (CVE-2025-43495). Correlate with app/web usage at the time of suspected initial access. (support.apple.com)
• Stolen Device Protection:
  • CVE-2025-43422 fixes a condition where physical attackers might disable Stolen Device Protection. Validate device state and lock behavior in incident windows. (support.apple.com)

tvOS/watchOS/visionOS/Safari/Xcode

• Safari 26.1 and WebKit Canvas cross-origin image exfil fixes-treat as browser-layer exposure on macOS and iOS-family platforms. (support.apple.com)
• Xcode 26.1 includes fixes (e.g., CVE-2025-43504, CVE-2025-43505). Patch developer build hosts-compromised toolchains poison everything downstream. (support.apple.com)

Detection Notes

• Browser-driven starts:
  • Hunt for WebKit child-process crashes, abnormal termination, or rapid tab/page transitions preceding first malicious execution. Use EDR telemetry for Safari/WebKit process trees and network egress at onset. (support.apple.com)
• Policy/tamper signals:
  • New grants in TCC (camera, mic, screen recording, All Files) or PPPC configuration changes on endpoints around incident time. Cross-check against expected MDM pushes. (support.apple.com)
• Gatekeeper and quarantine:
  • Files launched from Downloads or transient locations with missing or suspicious com.apple.quarantine attributes, or launch paths consistent with Finder/Gatekeeper bypass attempts (CVE-2025-43348). (support.apple.com)
• Media lure pathing:
  • Spikes in handling of images/models/fonts near first compromise (ImageIO/Model I/O/CoreText/FontParser). Even when only DoS is mentioned, memory-corruption bugs are historically chainable. (isc.sans.edu)

Response Guidance

• Prioritize patching by exposure:
  • Update iOS/iPadOS and Safari/macOS immediately on internet-facing and high-risk user groups (browsers get hit first). Apple’s pages confirm 26.1 availability on November 3, 2025 across the ecosystem. (support.apple.com)
• Validate MDM baselines:
  • Re-enforce PPPC/TCC baselines after OS updates to avoid drift. Confirm sensitive entitlements (All Files, Screen Recording, AppleEvents) aren’t newly granted without change control. (support.apple.com)
• Rebuild investigator assumptions:
  • Expect changed artifact visibility and mitigations: AppleMobileFileIntegrity now adds stricter code-signing/symlink validation, Sandbox/Sandbox Profiles and TCC harden data flows, and Finder/Gatekeeper checks tighten execution controls. This may reduce previously observable behaviors or alter exploit chains. (support.apple.com)
• Developer fleet hygiene:
  • Patch Xcode build stations (26.1) and validate toolchain integrity before releasing new binaries. (support.apple.com)

Takeaways

• Patch quickly-especially browsers and mobile endpoints-and enforce reboots to load new components. (support.apple.com)
• Expand hunts for WebKit-driven initial access coupled with sandbox and policy-bypass attempts (AppleMobileFileIntegrity, Sandbox/TCC). (support.apple.com)
• Refresh macOS DFIR playbooks: collect quarantine/TCC/Safari artifacts by default; expect new guardrails to change traces you typically rely on. (developer.apple.com)