Intel

CVE-2021-1870

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 7.7%

Description

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Source: REDHAT_CSAFCISA_KEVNVDCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2021-1870 carries a CVSS v3 score of 9.8 with a fully network-accessible, zero-interaction attack vector (AV:N/AC:L/PR:N/UI:N), meaning a malicious web page alone is sufficient to trigger remote code execution inside the WebKit renderer process. Apple confirmed active exploitation at the time of patching, which is the direct basis for CISA KEV inclusion. The EPSS score of 7.71 % (94th percentile) places this well above the vast majority of published CVEs in terms of real-world exploitation likelihood. For NIS2-scoped organisations running BYOD programmes or managed Apple device fleets, a single compromised WebKit process can serve as an initial foothold for lateral movement into corporate infrastructure. MDM-driven patch deployment is the highest-priority action; any device that cannot be patched within 24 hours must be treated as untrusted and isolated accordingly.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply vendor patches immediately: Update iOS/iPadOS to 14.4 (Settings → General → Software Update); update macOS Big Sur to 11.2; install "Security Update 2021-001" for macOS Catalina and Mojave — all available via Apple Software Update or MDM push.
  • Update WebKitGTK on Linux hosts: On Fedora and other affected Linux systems, upgrade WebKitGTK to at least 2.30.6 using dnf upgrade webkitgtk4 or apt-get upgrade libwebkit2gtk-4.0; document the resulting version in your asset inventory.
  • Isolate unpatched devices: Remove any iOS/iPadOS device below 14.4 and any macOS system below the patched versions from corporate Wi-Fi SSIDs and VPN profiles immediately, or move them to a quarantine VLAN with no access to internal resources.
  • Enforce MDM compliance policy: Set the minimum OS version in your MDM solution (Jamf, Microsoft Intune, Kandji) to iOS 14.4 / macOS 11.2; configure automatic blocking of non-compliant devices from corporate email and resource access.
  • Audit WebKit-dependent applications: Identify third-party apps using WKWebView or embedded WebKit (Electron apps, in-app browsers) on managed devices; block or restrict them until patch status is confirmed.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Keep mobile endpoints in a dedicated MDM VLAN; restrict outbound connections from iOS/macOS devices to external hosts using an allowlist-based Next-Generation Firewall policy.
  • DNS filtering: Enable DNS sinkholing for "Newly Registered Domains" and "Malware" categories (e.g. Cisco Umbrella, Infoblox) to reduce drive-by delivery vectors that exploit WebKit parsing.
  • TLS inspection and WAF: Enable TLS inspection on the corporate proxy; block or flag HTTP responses containing unusually large or obfuscated JavaScript payloads (inline scripts > 500 KB, Base64 blocks > 10 KB).
  • macOS hardening — SIP and sandbox: Verify that System Integrity Protection is enabled on all managed Macs (csrutil status); treat any SIP-disabled device as a compliance violation and escalate immediately.
  • Managed Content Filter (MDM payload): Restrict Safari to trusted internal URLs via the Content Filter payload; disable JavaScript on untrusted sites where operationally feasible to reduce the attack surface of the WebKit parser.

Runbook · Step 3

Detection rules

  • MDM telemetry: Alert when a device running iOS < 14.4 or macOS < 11.2 accesses corporate resources after the patch date. Splunk example: index=mdm os_version<"14.4" platform=iOS | stats count by device_id, user.
  • Proxy/DNS logs: Detect unusual redirect chains (≥ 3 HTTP 302 responses within 2 seconds) originating from iOS/macOS user-agents. Suricata rule shape: alert http any any -> any any (msg:"CVE-2021-1870 redirect chain"; flow:established,to_server; http.user_agent; content:"Mobile/"; detection_filter:track by_src, count 3, seconds 2; sid:2021870;).
  • EDR process ancestry (macOS): Flag any instance of WebContent or com.apple.WebKit.WebContent spawning unexpected child processes such as bash, sh, python, or curl. Sigma shape: ParentImage|endswith: 'WebContent' AND Image|endswith: ('bash','sh','python','curl').
  • macOS Unified Log: Run log stream --predicate 'subsystem == "com.apple.WebKit"' | grep -i "exception\|crash\|exploit" — repeated WebKit crashes in a short window are a strong indicator of active exploitation attempts.
  • Network telemetry (Zeek): Classify as high-severity any session where an iOS/macOS host connects to a domain registered within the last 30 days and subsequently downloads a JavaScript file larger than 200 KB within the same connection.

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
9.8
CVSS v4
—
EPSS percentile
94.3 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
7.7 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2021-1870