WebKit Under Attack: Apple Issues Emergency Patches for 3 New Zero

CVE-2023-23529 is a type confusion flaw (CWE-843) in Apple's WebKit engine, which renders web content in Safari and in the system web components of iOS, iPadOS, and macOS. It is triggered when a device processes maliciously crafted web content, typically when a user is lured into viewing an attacker-controlled web page or other web-rendered content. Successful exploitation can lead to arbitrary code execution with the privileges of the affected application (CVSS 3.1: 8.8, network vector, requiring user interaction). Affected users are those running iOS/iPadOS versions before the February 2023 fixes, macOS Ventura before 13.2.1, or Safari before 16.3. Apple reported the issue may have been actively exploited before patching, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-02-14; no public proof-of-concept is known.

Do: Apply the vendor updates immediately per CISA's KEV required action: iOS/iPadOS 16.3.1 (or 15.7.4 for devices remaining on the iOS 15 branch), macOS Ventura 13.2.1, and Safari 16.3. Inventory managed iPhones, iPads, and Macs to verify updated versions, prioritizing devices used to browse untrusted web content. As an interim mitigation, treat untrusted links and web content with caution until all endpoints are patched.

CVE-2023-32373 is a use-after-free memory-corruption flaw (CWE-416) in WebKit, the web-content engine used across Apple's platforms. It is triggered when an affected device processes maliciously crafted web content, such as a hostile webpage or embedded web view, and requires user interaction. A successful attacker gains arbitrary code execution on the victim device, with high impact to confidentiality, integrity, and availability (CVSS 3.1 score of 8.8). All products shipping vulnerable WebKit are exposed, including iPhone, iPad, Mac (Ventura), Apple Watch, Apple TV, and Safari, plus WebKitGTK-based packages such as those in Red Hat Enterprise Linux. Apple reports the flaw may have been actively exploited; CISA added it to the Known Exploited Vulnerabilities catalog on 2023-05-22, and fixes shipped in iOS/iPadOS 16.5 and 15.7.6, macOS Ventura 13.4, Safari 16.5, watchOS 9.5, and tvOS 16.5.

Do: Upgrade to the fixed releases: iOS/iPadOS 16.5 (or 15.7.6 on older devices), macOS Ventura 13.4, Safari 16.5, watchOS 9.5, and tvOS 16.5, and apply Red Hat's updated WebKitGTK packages on affected Linux systems. Because the flaw is in CISA's KEV catalog and reported as actively exploited, federal agencies and prioritized defenders should patch by the KEV deadline. Users who cannot update immediately should avoid browsing untrusted web content, and admins should verify installed OS and Safari versions against the fixed releases.

CVE-2023-28205 is a use-after-free flaw (CWE-416) in the WebKit engine shipped with Apple iOS, iPadOS, macOS, and the Safari browser, where memory is freed and then incorrectly reused while processing HTML. It is triggered when a device processes maliciously crafted web content, meaning simply loading an attacker-controlled page in Safari or any WebKit-based HTML renderer can trigger the bug. Successful exploitation allows the attacker to achieve code execution in the context of the WebKit process on the victim device. All users of iOS, iPadOS, macOS, and Safari are potentially affected, as are non-Apple products that rely on WebKit for HTML processing. The flaw is being actively exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-04-10, with the required action to apply updates per vendor instructions — and EPSS assigns a 27.1% probability of exploitation within 30 days (98th percentile).

Do: Apply Apple's current security updates for iOS, iPadOS, macOS, and Safari as soon as possible, per the vendor instructions cited in the CISA KEV listing. Because this is a browser/HTML-engine flaw exploited in the wild, prioritize patching internet-facing and high-risk user fleets; users of non-Apple WebKit-based HTML parsers should check with their software vendors for updated WebKit components. Until patched, exercise caution with untrusted web content.

Apple's IOSurfaceAccelerator component in iOS, iPadOS, and macOS contains an out-of-bounds write flaw (CWE-787). The bug is triggered by an application running locally on the device, which can corrupt memory in the component during a write past a buffer boundary. A successful exploit allows the app to execute arbitrary code with kernel privileges, giving it full control of the device beyond the normal app sandbox. Any user of an Apple iOS, iPadOS, or macOS device running an affected, unpatched version is exposed. The flaw was added to CISA KEV on 2023-04-10, confirming known in-the-wild exploitation; ransomware use is unknown, no public PoC is available, and EPSS assigns a 24.5% probability of exploitation within 30 days (98th percentile).

Do: Update all iPhones, iPads, and Macs to the latest iOS/iPadOS/macOS versions available as of April 2023, per CISA's required action and Apple's security advisories. Use MDM or patch-reporting tooling to inventory endpoints and confirm no devices remain on pre-patch builds. Because exploitation is confirmed in the wild and any local app can act as the trigger, patching is the primary mitigation and there is no dependable configuration workaround.