Intel

CVE-2021-1789

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 14%

Description

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code execution.

Source: REDHAT_CSAFCISA_KEVNVDCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2021-1789 is a zero-interaction-from-the-server-side vulnerability: the attacker needs only to lure a user to a malicious page — no authentication, no elevated privileges, no complex preconditions (CVSS vector AV:N/AC:L/PR:N/UI:R). An EPSS score at the 96.5th percentile places it among the most likely-to-be-exploited CVEs across the entire NVD corpus, making deferral of patching difficult to justify. For NIS2-scoped organisations, the risk is amplified by the breadth of affected Apple platforms — macOS workstations, iPhones, iPads, Apple TVs in meeting rooms, and Apple Watches — many of which sit outside the standard Windows-centric patch pipeline. Organisations with BYOD programmes or unmanaged Apple endpoints should treat this as a priority-one item regardless of the absence of a confirmed ransomware campaign flag.

Runbook · Step 1

Immediate response (0-24 h)

  • iOS/iPadOS: Force-update to iOS 14.4 / iPadOS 14.4 via Settings → General → Software Update; set MDM minimum-version enforcement (Jamf, Microsoft Intune) to 14.4 and quarantine non-compliant devices from corporate network access immediately.
  • macOS: Deploy Security Update 2021-001 for Catalina (10.15.7) and Mojave (10.14.6), and macOS Big Sur 11.2, via Apple Software Update or MDM; disconnect unpatched machines from internal networks until the update is confirmed.
  • Safari: Update to Safari 14.0.3; on macOS systems that cannot receive an OS update, disable Safari and mandate an alternative browser without a WebKit engine (e.g. Firefox) as a temporary compensating control.
  • tvOS/watchOS: Roll out tvOS 14.4 and watchOS 7.3 via automatic updates or Apple Configurator; place Apple TV devices in a dedicated VLAN without direct internet access until the patch is verified.
  • End-of-life systems: macOS versions prior to 10.14 receive no fix — take these systems offline immediately or route all web traffic through a TLS-inspecting proxy with strict content filtering.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Move unpatched endpoints into a quarantine VLAN; permit outbound HTTP/HTTPS (TCP 80/443) only through a central proxy that blocks known exploit-delivery and malware-distribution domains.
  • Web proxy / content filtering: Restrict JavaScript execution on untrusted domains via proxy policy; block URL categories "Newly Registered Domains" and "Malware Distribution" at the gateway.
  • WAF/IPS rule: Enable Suricata ET categories exploit.kit and js.obfuscation for HTTP responses; activate Snort community rules targeting WebKit-based exploit patterns to catch drive-by delivery attempts.
  • Endpoint hardening: Keep macOS Gatekeeper and XProtect fully up to date; minimise Safari extensions; disable JavaScript in Safari (Preferences → Security) where operationally feasible.
  • IAM / least privilege: Ensure browser processes run without administrative rights — enforce standard (non-admin) user accounts on all macOS endpoints to limit post-exploitation impact.
  • Email gateway: Apply URL rewriting and time-of-click sandbox analysis to all inbound links, since the attack vector is triggered by visiting attacker-controlled web content, often reached via phishing links.

Runbook · Step 3

Detection rules

  • EDR / endpoint: Monitor process ancestry — WebContent or com.apple.WebKit.WebContent spawning unexpected child processes such as sh, bash, python3, or curl; Sigma shape: ParentImage|endswith: 'WebContent' AND Image|endswith: ('sh','bash','python3','curl').
  • macOS Unified Log / auditd: Watch for execve calls originating from within the Safari WebKit sandbox container (/private/var/folders/…/com.apple.WebKit.WebContent*) targeting unusual binaries; auditd rule: -a always,exit -F arch=b64 -S execve -F uid!=0 -k webkit_exec.
  • Network telemetry (Zeek/Suricata): Flag HTTP responses with Content-Type text/html or application/javascript containing large Base64-encoded blocks matching /[A-Za-z0-9+/]{200,}={0,2}/; trigger on single JavaScript responses exceeding 500 KB as a potential payload indicator.
  • Proxy logs: Correlate AppleWebKit User-Agent strings accessing recently registered domains (<30 days old) followed within 60 seconds by DNS lookups to a second, previously unseen domain — SPL snippet: index=proxy useragent="*AppleWebKit*" | join domain [search index=dns] | where dns_age_days < 30.
  • macOS Endpoint Security Framework: Deploy an ESF-capable EDR agent to capture mach_msg anomalies and unexpected memory-region access patterns originating from the WebKit renderer process.

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
96.4 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
14.5 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2021-1789