EXPOSURES › CVE-2021-30665
CVE-2021-30665
HIGH ⌖ ON CISA KEV · EXPLOITEDApple's WebKit memory corruption flaw in iOS, macOS, and other OSes allows remote code execution via malicious web content.
A memory corruption vulnerability in Apple's WebKit engine enables remote code execution when processing malicious web content, affecting Safari and any non-Apple products relying on WebKit. DIB organizations must ensure all Apple devices and WebKit-dependent systems are patched immediately, as this flaw is actively exploited in the wild and represents a significant compliance risk under NIST 800-171 for unpatched vulnerabilities.
Shame score — This is a high-severity, actively exploited memory corruption flaw affecting core OS components across Apple's ecosystem, demonstrating a critical failure in patching and vulnerability management that directly impacts DIB compliance.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
"This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing."