Intel

CVE-2021-30663

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 3.5%

Description

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution.

Source: REDHAT_CSAFCVELISTV5CISA_KEVNVDCVEORG

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2021-30663 carries a CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and sits at the 88th EPSS percentile, reflecting a realistic probability of exploitation against unpatched targets. The low attack complexity combined with the breadth of affected platforms — iOS, iPadOS, macOS, tvOS, and Safari — makes this an efficient vehicle for drive-by campaigns where a single click on a crafted URL delivers arbitrary code execution in the browser process. NIS2-scoped organisations with a significant Apple device footprint in field operations or executive layers face elevated risk, as high-privilege users frequently rely on mobile devices for email and internal web access. The absence of a CISA-confirmed ransomware campaign flag does not reduce urgency — it reflects the intelligence picture at the time of KEV inclusion, and the vulnerability is well-suited as an initial access vector in multi-stage attack chains.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply vendor patches now: Update iOS/iPadOS to 14.5.1, macOS Big Sur to 11.3.1, tvOS to 14.6, Safari to 14.1.1, and legacy iOS 12.x devices to 12.5.3 — all updates are available via Apple Software Update.
  • Isolate unpatched devices: Any corporate iPhone, iPad, or Mac that cannot reach the minimum OS version (e.g. older hardware) must be immediately removed from the corporate network or placed in a restricted quarantine VLAN.
  • Disable Safari on unpatched macOS endpoints: Use your MDM (Jamf, Mosyle, or equivalent) to block Safari from opening arbitrary URLs until the patch is deployed across the fleet.
  • Enforce MDM compliance policy: Mark devices below the minimum OS version as non-compliant and revoke access to Exchange ActiveSync, VPN, and internal web applications.
  • Force browsing traffic through a TLS-inspecting proxy: Route all HTTP/HTTPS traffic (ports 80/443) from iOS/macOS endpoints through a proxy capable of TLS inspection to intercept malicious web content before it reaches WebKit.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place Apple endpoints in a dedicated client VLAN; restrict outbound connections to known, categorised domains using a DNS firewall allowlist (e.g. Cisco Umbrella or equivalent).
  • Secure Web Gateway — block newly registered domains: Domains registered within the last 30 days are a common delivery vehicle for drive-by WebKit exploits; block them at the proxy layer for all Apple device traffic.
  • Restrict JavaScript execution: Where operationally feasible, disable JavaScript in Safari (Settings → Advanced → JavaScript) or enforce the restriction via MDM configuration profile — this significantly reduces attack surface since the integer overflow is triggered during web content parsing.
  • Enable IPS signatures: Activate Suricata/Snort signatures covering WebKit integer-overflow exploit patterns (Suricata ET category "exploit") on egress paths of client VLANs; check for community signatures specifically referencing CVE-2021-30663.
  • Verify macOS hardening baseline: Confirm Gatekeeper and System Integrity Protection (SIP) are both enabled on all macOS endpoints (csrutil status); this limits the blast radius of a compromised WebKit renderer process.
  • tvOS devices without update path: Apple TV units that cannot be updated to tvOS 14.6 should be disconnected from the internet or confined to an isolated entertainment VLAN with no corporate network access.

Runbook · Step 3

Detection rules

  • Proxy/firewall logs: Connections from iOS/macOS endpoints to newly registered or uncategorised domains followed by anomalous outbound traffic patterns — SPL: index=proxy src_category="apple_device" url_category="Newly Registered Domain" | stats count by src, dest_host
  • EDR process tree (macOS): Child processes of com.apple.WebKit.WebContent or SafariServices spawning shell processes (sh, bash, zsh) or initiating network connections outside the browser context — Sigma shape: ParentImage|endswith: 'com.apple.WebKit.WebContent' + Image|endswith: '/bin/sh'
  • macOS Unified Log / auditd: Unexpected execve calls originating from within the WebKit sandbox container (com.apple.WebKit.WebContent) — auditd rule: -a always,exit -F arch=b64 -S execve -F ppid=<webkit_pid> -k webkit_exec
  • MDM compliance alerts: Devices still reported as non-compliant after the patch deadline — escalate directly into the SIEM or ticketing system for hands-on remediation.
  • Network telemetry (Zeek): HTTP responses containing unusually large integer values in HTML attributes or JavaScript payloads consistent with heap-spray patterns — deploy a Zeek anomaly-detection script on egress mirrors of client VLANs.

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
88.4 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
3.5 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2021-30663