CVE-2021-30952: Apple Multiple Products integer overflow in WebKit content processing

CVE-2021-30952 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2026-03-05

A security vulnerability exists in several Apple operating systems and the Safari web browser that allows attackers to run unauthorized code on a device. This occurs when a user visits a specially crafted, malicious website. If exploited, an attacker could gain control over the device, potentially leading to the theft of personal data or disruption of operations. This vulnerability has been observed being used in active attacks.

Technologies: Apple iPadOS, Apple macOS Monterey, Apple Multiple Products, Apple Safari, Apple Tvos, Apple watchOS. Vendors: Apple.

Quick answers

Is CVE-2021-30952 exploited in the wild?
Yes. CVE-2021-30952 is known to be exploited in the wild, first recorded on 5 March 2026. Treat it as urgent.
How severe is CVE-2021-30952?
Critical severity, with a CVSS score of 8.8, published 5 March 2026.
Which products and versions are affected?
Apple iPadOS Before 15.2; Apple macOS Monterey Before 12.1; Apple Safari Before 15.2; Apple Tvos Before 15.2; and 1 more.
Is there a fix for CVE-2021-30952?
A patch was published on 2021-12-13: Fixes released in iOS 15.2, macOS 12.1, and Safari 15.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-30952 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2021-30952?
Check whether you run Apple iPadOS, Apple macOS Monterey, Apple Multiple Products or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability (CWE-190) exists in the processing of web content across multiple Apple platforms, including iOS, macOS, and Safari. The root cause is insufficient input validation when handling maliciously crafted web content, likely within the WebKit engine. An attacker can exploit this by enticing a user to visit a malicious webpage, leading to arbitrary code execution with the privileges of the browser process. This vulnerability was reportedly used as part of an exploit kit. Apple addressed the issue by improving input validation in updates released for all affected platforms.

Affected products

  • Apple iOS and iPadOS Before 15.2
  • Apple macOS Monterey Before 12.1
  • Apple tvOS Before 15.2
  • Apple watchOS Before 8.3
  • Apple Safari Before 15.2

Timeline

  • 2021-12-13: patched: Fixes released in iOS 15.2, macOS 12.1, and Safari 15.2
  • 2026-03-05: kev added: Added to CISA Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.