Exploit / PoCcriticalExploited in the wild

Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13

The Hacker Newsby @TheHackersNewsMar 26, 2026 · 10:55 UTC (Mar 26, 2026)8 min read5 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2024-23222 CVE-2022-48503 CVE-2023-43000 CVE-2020-27932 CVE-2020-27950 CVE-2021-30952 CVE-2023-32409 CVE-2023-32434 CVE-2023-38606 CVE-2023-41974 CVE-2024-23225 CVE-2024-23296

Tags: cve-2020-27932 cve-2020-27950 cve-2022-48503 cve-2023-43000 cve-2024-23222 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2020-27932 +1 related CVE CVE-2020-27950	Kernel Type Confusion in Apple iOS, macOS, watchOS Allows Code Execution (CVE-2020-27932)	7.8 group max	10%	KEV	Dec 8, 2020 KEV Nov 3, 2021
CVE-2021-30952	CVE-2021-30952: Integer Overflow in Apple Safari/WebKit Allows Arbitrary Code Execution	7.8	7%	KEVPoC	Aug 24, 2021 KEV Mar 5, 2026
CVE-2022-48503	Apple Web Content Bounds-Check Flaw Enables Code Execution Across iOS, macOS, Safari	8.8	3%	KEV	Aug 14, 2023 KEV Oct 20, 2025
CVE-2023-32409 +1 related CVE CVE-2023-32434	WebKit Sandbox Escape in Apple Safari, iOS, iPadOS, macOS, tvOS, and watchOS	8.6 group max	17%	KEV	Jun 23, 2023 KEV May 22, 2023
CVE-2023-38606	Kernel State-Tampering Flaw in Apple iOS, iPadOS, macOS, tvOS and watchOS	5.5	3%	KEV	Jul 27, 2023 KEV Jul 26, 2023
CVE-2023-41974	Use-After-Free Kernel Code Execution Flaw in Apple iOS and iPadOS	7.8	2%	KEVPoC	Jan 10, 2024 KEV Mar 5, 2026
CVE-2023-43000	Use-After-Free in Apple WebKit: Safari, iOS, iPadOS, macOS (CVE-2023-43000)	8.8	4%	KEVPoC	Nov 5, 2025 KEV Mar 5, 2026
CVE-2024-23222	Apple WebKit Type Confusion Enables Arbitrary Code Execution Across iOS, macOS, tvOS	8.8	11%	KEV	Jan 23, 2024 KEV Jan 23, 2024
CVE-2024-23225 +1 related CVE CVE-2024-23296	Memory Corruption Kernel Protection Bypass in Apple iOS, macOS, tvOS, visionOS	7.8	1%	KEV	Mar 5, 2024 KEV Mar 6, 2024

Indicators of compromise

auto-extracted · verify before use · export allAll

Type	Indicator	Context
domain	uacounter.com	e same JavaScript framework was detected on the domain "cdn.uacounter[.]com," which was loaded as a hidden iFrame on compromised Ukra

From the original article

8 min read at thehackernews.com

Google said it identified a "new and powerful" exploit kit dubbed Coruna (aka CryptoWaters) targeting Apple iPhone models running iOS versions between 13. 0 and 17. 2.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.