Apple WebKit CVE-2024-23222
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, visionOS 1.0.2. Processing maliciously crafted web content may lead to arbitrary code execution. This fix associated with the Coruna exploit was shipped in iOS 17.3 on January 22, 2024. This update brings that fix to devices that cannot update to the latest iOS version.
AnalysisAI
Arbitrary code execution in Apple WebKit affects Safari and the system browser engine across iOS, iPadOS, macOS, tvOS, and visionOS, where a type confusion flaw allows attackers to execute code via maliciously crafted web content. The vulnerability is confirmed actively exploited (CISA KEV) and was used in the Coruna exploit chain against older iOS devices before being backported to legacy versions. EPSS sits at 0.62% (70th percentile), consistent with targeted exploitation rather than mass scanning.
Technical ContextAI
WebKit is Apple's browser engine that powers Safari and is mandatorily used by all third-party iOS browsers under App Store rules, giving it an enormous attack surface across Apple's ecosystem. CWE-843 (Access of Resource Using Incompatible Type, or 'type confusion') means the engine's JavaScript or DOM handling code interprets an object of one type as another - typically allowing an attacker to manipulate memory layout, bypass bounds, and pivot to arbitrary read/write primitives that lead to native code execution within the renderer process. The CPE coverage spans iPadOS, iPhone OS, macOS, and tvOS, indicating the flaw is in the shared WebKit codebase rather than a platform-specific binding.
RemediationAI
Vendor-released patches: update to Safari 17.3, iOS/iPadOS 15.8.7, iOS/iPadOS 16.7.5, iOS/iPadOS 17.3, macOS Monterey 12.7.3, macOS Ventura 13.6.4, macOS Sonoma 14.3, tvOS 17.3, or visionOS 1.0.2 - the backport to 15.x and 16.x is specifically intended for devices that cannot move to the latest major OS. In enterprise fleets, push the updates via MDM (Apple Configurator, Jamf, Intune) and verify via build numbers in the device inventory. If immediate patching is impossible, enable Lockdown Mode on high-risk users' devices (which disables several WebKit JIT and complex web technologies at the cost of broken sites and reduced functionality), restrict browsing to a hardened reverse-proxy or enforce SafeSearch/category filtering to reduce drive-by exposure, and educate users not to follow links from untrusted sources. Note that because all third-party iOS browsers use WebKit, switching browsers on iOS does not mitigate the issue.
More from same product – last 7 days
Arbitrary command execution in IINA media player for macOS versions prior to 1.4.3 allows remote attackers to run shell
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config
Arbitrary code execution in Docker Model Runner's vllm-metal inference backend on macOS allows any container on the Dock
Arbitrary code execution in Docker Desktop's Model Runner on macOS allows any container on the Docker network to escape
Local privilege escalation in Apple macOS allows a malicious app already running with low privileges to elevate to root
Share
External POC / Exploit Code
Leaving vuln.today