Intel

CVE-2021-30661

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 4.5%

Description

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Source: REDHAT_CSAFCVELISTV5CISA_KEVNVDCVEORG

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2021-30661 carries a CVSS v3 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and sits at the 90.8th EPSS percentile, placing it among the highest-probability-of-exploitation vulnerabilities across the entire CVE corpus. The attack requires only that a user visit a malicious page — no authentication, no local access, no elevated privileges on the attacker's side. For organisations with significant Apple device fleets, BYOD programmes, or executive populations using Safari, the attack surface is broad and the barrier to exploitation is low. Because WebKit is embedded in third-party applications beyond Apple's own ecosystem, patching Apple OS versions alone may not fully close the exposure — all WebKit-dependent software must be inventoried and assessed. CISA has not flagged ransomware campaign use, but the vulnerability's ability to deliver arbitrary code execution via a single browser interaction makes it highly attractive for targeted intrusion campaigns, including credential harvesting and persistent implant delivery.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply vendor patches immediately: Update Safari to 14.1, iOS/iPadOS to 14.5 (or 12.5.3 for legacy devices), macOS Big Sur to 11.3, tvOS to 14.5, and watchOS to 7.4 — all updates are available via Apple Software Update and MDM.
  • Audit patch compliance across all Apple endpoints via MDM: Any device not yet updated should be isolated from the corporate network or have VPN access revoked until the patch is confirmed installed.
  • Identify WebKit-embedded third-party applications: Applications using WebKit as a rendering engine outside of Apple's own products (e.g. Electron apps, cross-platform frameworks) must be assessed separately — check vendor advisories for each.
  • Restrict browsing on unpatched devices: Until patch confirmation, enforce proxy-based allowlisting to prevent unpatched devices from loading arbitrary web content.
  • Prioritise triage for high-value users: Administrators, executives, and IT staff using Apple devices are the most likely targets of watering-hole and spear-phishing delivery. Investigate these accounts first for signs of compromise.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Move unpatched Apple devices into a restricted VLAN with outbound traffic limited to an approved allowlist proxy until patching is complete.
  • DNS/web proxy filtering: Block categories such as "Newly Registered Domains", "Malware Distribution", and "Uncategorized" at the proxy or DNS resolver — these are the most common delivery vectors for browser exploit pages.
  • WAF/IPS rule: Inspect inbound HTTP responses for oversized or deeply nested HTML storage structures (e.g. abnormal localStorage manipulation, large obfuscated <script> blocks); apply Snort/Suricata rules targeting known exploit-kit signatures on text/html content types.
  • macOS hardening: Verify that App Sandbox and System Integrity Protection (SIP) are enabled on all managed macOS endpoints — check via csrutil status. These controls limit post-exploitation lateral movement even if the initial exploit succeeds.
  • MDM compliance policy: Enforce a policy in Apple Business Manager or Jamf that automatically marks devices running affected OS versions as non-compliant and blocks access to corporate resources (email, VPN, internal portals).
  • Disable JavaScript as an emergency measure: On Safari, JavaScript can be disabled under Settings → Safari → Advanced → JavaScript — this breaks the exploit chain but severely limits usability; treat as a short-term bridge only.

Runbook · Step 3

Detection rules

  • EDR process tree (macOS): Flag Safari or com.apple.WebKit.WebContent spawning unexpected child processes such as bash, sh, python3, curl, or osascript. Sigma shape: ParentImage|endswith: 'Safari' AND Image|endswith: ('bash','sh','python3','osascript').
  • macOS Unified Log / crash reports: Monitor /Library/Logs/DiagnosticReports/ for crash reports from com.apple.WebKit.WebContent with signal types SIGSEGV or SIGABRT — a cluster of such crashes indicates active exploitation attempts, even unsuccessful ones.
  • Network telemetry (Zeek/Suricata): Alert on outbound connections originating from WebContent processes to unknown IPs immediately after loading an external page, especially on non-standard ports or with Base64-encoded URI parameters.
  • Web proxy logs: Flag HTTP responses with Content-Type: text/html, payload size > 2 MB, and JavaScript bodies containing eval(), unescape(), or String.fromCharCode(). SPL snippet: index=proxy content_type="text/html" bytes_out>2000000 | search uri_query="*eval*" OR uri_query="*unescape*".
  • MDM compliance alerts: Escalate to the SIEM any device still running an affected OS version beyond the internal patch deadline (recommended: 48 hours after KEV addition) as an active unmitigated risk.

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
90.9 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
4.5 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2021-30661