Executive brief
A security vulnerability exists in several Apple operating systems and the Safari web browser that allows attackers to run unauthorized code on a device. This occurs when a user visits a specially crafted, malicious website. If exploited, an attacker could gain control over the device, potentially leading to the theft of personal data or disruption of operations. This vulnerability has been observed being used in active attacks.
Technical details
An integer overflow vulnerability (CWE-190) exists in the processing of web content across multiple Apple platforms, including iOS, macOS, and Safari. The root cause is insufficient input validation when handling maliciously crafted web content, likely within the WebKit engine. An attacker can exploit this by enticing a user to visit a malicious webpage, leading to arbitrary code execution with the privileges of the browser process. This vulnerability was reportedly used as part of an exploit kit. Apple addressed the issue by improving input validation in updates released for all affected platforms.
Affected products
- Apple iOS and iPadOS Before 15.2
- Apple macOS Monterey Before 12.1
- Apple tvOS Before 15.2
- Apple watchOS Before 8.3
- Apple Safari Before 15.2
Timeline
- 2021-12-13: patched: Fixes released in iOS 15.2, macOS 12.1, and Safari 15.2
- 2026-03-05: kev added: Added to CISA Known Exploited Vulnerabilities catalog