Search: “webkit”

187 items

Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.

ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.

Zero Day Initiative BlogSep 16, 19:58 UTC · 13h agoVulnerability in the wildCVE-2026-65400 CVE-2026-65414 CVE-2026-43692+27 CVEs

Apple fixes WebKit 0-days under attack (CVE-2023-28204, CVE-2023-32373, CVE-2023-32409)

Help Net SecurityMay 19, 00:00 UTC · May 19, 2023Vulnerability in the wildCVE-2023-28204 CVE-2023-32373 CVE-2023-32409

Apple patches iPhone zero

The RecordDec 16, 00:00 UTC · Dec 16, 2022Vulnerability in the wildCVE-2021-30883 CVE-2021-30807 CVE-2021-1782+14 CVEs

Apple Releases Urgent iPhone and iPad Updates to Patch New Zero

The Hacker NewsOct 20, 05:21 UTC · Oct 20, 2021Vulnerability in the wildCVE-2021-30883 CVE-2021-30807 CVE-2021-1782+14 CVEs

Vulnerability Spotlight: Remote code execution vulnerability in WebKit WebAudio API

Cisco TalosMar 3, 14:59 UTC · Mar 3, 2021Vulnerability in the wildCVE-2020-13558

Apple releases fix for iOS and macOS zero

The RecordDec 10, 00:00 UTC · Dec 10, 2022Exploit / PoC in the wildCVE-2021-30807 CVE-2021-1782 CVE-2021-1870+10 CVEs

Apple Releases Urgent 0-Day Bug Patch for Mac, iPhone and iPad Devices

The Hacker NewsJul 27, 11:14 UTC · Jul 27, 2021Vulnerability in the wildCVE-2021-30807 CVE-2021-1782 CVE-2021-1870+10 CVEs

Apple Issues Urgent Patches for 2 Zero

The Hacker NewsJun 15, 00:00 UTC · Jun 15, 2021Vulnerability in the wildCVE-2021-30737 CVE-2021-30761 CVE-2021-30762+10 CVEs

WebKit Under Attack: Apple Issues Emergency Patches for 3 New Zero

The Hacker NewsMay 20, 04:03 UTC · May 20, 2023Vulnerability in the wildCVE-2023-32409 CVE-2023-28204 CVE-2023-32373+3 CVEs

Apple fixed 2 WebKit flaws exploited to target older iPhones

Security AffairsJun 14, 23:08 UTC · Jun 14, 2021Vulnerability in the wildCVE-2021-30761 CVE-2021-30762 CVE-2021-30737

Apple Fixes WebKit Vulnerability Enabling Same

The Hacker NewsMar 18, 06:31 UTC · Mar 18, 2026Vulnerability in the wildCVE-2026-20643 CVE-2026-20700 CVE-2023-43010+3 CVEs

Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild

The Hacker NewsFeb 10, 14:22 UTC · Feb 10, 2026Exploit / PoC in the wildCVE-2025-43529 CVE-2025-14174 CVE-2025-24085+6 CVEs

iOS 18.3.2 Patches Actively Exploited WebKit Vulnerability

Infosecurity MagazineMar 12, 17:00 UTC · Mar 12, 2025Vulnerability in the wildCVE-2025-24201

Apple backports fix for exploited WebKit bug to older iPhones, iPads (CVE-2023-23529)

Help Net SecurityMar 28, 00:00 UTC · Mar 28, 2023Vulnerability in the wildCVE-2023-23529 CVE-2023-27951 CVE-2023-23537+1 CVEs

CISA adds iPhone bugs to Known Exploited Vulnerabilities catalog

Security AffairsMay 22, 18:37 UTC · May 22, 2023Exploit / PoC in the wildCVE-2023-32409 CVE-2023-28204 CVE-2023-32373

Week in review: KeePass vulnerability, Apple fixes exploited WebKit 0-days

Help Net SecurityMay 21, 00:00 UTC · May 21, 2023Vulnerability in the wildCVE-2023-28204 CVE-2023-32373 CVE-2023-32409+1 CVEs

Apple fixes actively exploited WebKit zero-day in iOS, macOS (CVE-2023-23529)

Help Net SecurityFeb 14, 00:00 UTC · Feb 14, 2023Exploit / PoC in the wildCVE-2023-23529 CVE-2023-23514

Apple released patches for recently disclosed WebKit zero

Security AffairsSep 1, 08:06 UTC · Sep 1, 2022Vulnerability in the wildCVE-2022-32893 CVE-2022-22587 CVE-2022-22594+3 CVEs1

Google’s AI ‘Big Sleep’ Finds 5 New Vulnerabilities in Apple’s Safari WebKit

The Hacker NewsNov 6, 04:36 UTC · Nov 6, 2025Vulnerability in the wildCVE-2025-43429 CVE-2025-43430 CVE-2025-43431+3 CVEs

Apple Releases Patch for WebKit Zero-Day Vulnerability Exploited in Targeted Attacks

The Hacker NewsMar 12, 11:52 UTC · Mar 12, 2025Exploit / PoC in the wildCVE-2025-24201 CVE-2025-24085 CVE-2025-24200

Apple fixes actively exploited WebKit zero-day (CVE-2024-23222)

Help Net SecurityFeb 15, 11:54 UTC · Feb 15, 2024Exploit / PoC in the wildCVE-2024-23222 CVE-2023-42916 CVE-2023-429171

Apple fixes four zero-days under attack

Help Net SecurityFeb 5, 13:55 UTC · Feb 5, 2024Exploit / PoC in the wildCVE-2021-30665 CVE-2021-30663 CVE-2021-30666+1 CVEs

13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Trojanized Packagist themes inject JavaScript into Vietnamese streaming sites, exploiting unpatched iPhone WebKit and kernel flaws to install spyware and steal crypto wallet seeds.

Socket researchers found 13 malicious Composer theme packages across five vendor namespaces (including vsmov, vsphim, and ophimcms) that inject JavaScript into Vietnamese movie and comic streaming sites. On iPhones running iOS 18.4-18.6.x, the injected code fires a WebKit-to-kernel exploit chain using CVE-2025-31277 and CVE-2025-43529, pivoting through the GPU process and the AppleM2ScalerCSCDriver IOKit user client to gain kernel read/write. Since around August 12, 2026 the payload also steals cryptocurrency wallet seeds and mnemonics from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX, alongside keychain databases, Wi-Fi passwords, SMS, photos, cookies, and location history, uploaded via HTTPS to rotating C2 domains. The group is believed to be Vietnamese-operated, hosts exploits on Funnull infrastructure, and Apple patched the kernel escape flaw in iOS and macOS 26.1.

The Hacker NewsSep 2, 06:24 UTC · 15d agoExploit / PoC in the wildCVE-2025-31277 CVE-2025-43529 CVE-2025-43398+2 CVEs