Intel

CVE-2021-30762

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 11%

Description

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Source: REDHAT_CSAFCISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2021-30762 carries a CVSS 8.8 score with a network-accessible, no-privilege-required vector and an EPSS score in the 95.6th percentile, placing it among the most statistically likely vulnerabilities to be actively exploited in any given organisation's environment. Apple itself confirmed active exploitation at the time of disclosure, which is the primary driver for CISA KEV inclusion. The affected population is narrow — only iOS 12.x devices — but that population is disproportionately present in KRITIS and industrial environments where older iPhones and iPads serve as dedicated field or control-interface devices that cannot be upgraded to iOS 14/15. The user-interaction requirement (opening a crafted page) is easily satisfied via phishing or malvertising, making this a realistic threat even without sophisticated attacker infrastructure. Organisations should treat any unpatched iOS 12.x device as a high-risk endpoint and remove it from production network access until iOS 12.5.4 is confirmed installed.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch immediately: Update all affected devices to iOS 12.5.4 (Apple Security Update HT212548). Devices running any iOS 12.x release below 12.5.4 are the sole affected population — prioritise them above all other iOS patch work.
  • Inventory all iOS 12.x devices via your MDM (Jamf, Microsoft Intune, or equivalent). Flag every device below iOS 12.5.4 as critical and enforce a Conditional Access block on corporate resources until patch compliance is confirmed.
  • Disable Safari and WebKit-based in-app browsers on unpatched devices via MDM managed configuration profile. If disabling is not feasible, push a Conditional Access policy that quarantines non-compliant devices from email, VPN, and SaaS services.
  • Alert users immediately: The attack vector is a maliciously crafted web page — a single link click is sufficient. Issue an advisory telling staff not to open unsolicited URLs on any iOS device until patch status is confirmed.
  • Update Mobile Threat Defense (MTD) signatures (Lookout, Microsoft Defender for Endpoint on iOS, or equivalent) and verify that WebKit exploit detection categories are active and forwarding alerts to your SIEM.

Runbook · Step 2

Mitigation layers

  • TLS-inspecting proxy / network segmentation: Route all iOS device traffic through a TLS-inspecting proxy (Zscaler, Palo Alto Prisma Access). Block outbound connections to newly registered or low-reputation domains — this disrupts exploit delivery before the payload reaches WebKit.
  • MDM Conditional Access enforcement: Bind corporate resource access to MDM compliance state. Devices reporting iOS < 12.5.4 should land in a quarantine VLAN with no access to internal systems.
  • Managed Content Filter profile: Deploy an MDM configuration profile that enforces a URL allowlist in Safari on corporate-supervised devices, preventing navigation to arbitrary external sites.
  • Reverse-proxy / WAF rule: Throttle or block inbound responses with abnormally large or deeply nested HTML payloads (> 500 KB body, DOM nesting depth > 50 levels) on any internally hosted web application — reduces the attack surface for internally served exploit pages.
  • Temporary JavaScript disable: As a last-resort compensating control on unpatched supervised devices, push an MDM profile that disables JavaScript in Safari. This breaks most web functionality but eliminates the primary exploit execution path.

Runbook · Step 3

Detection rules

  • MDM compliance telemetry: Continuously query for devices with iOS < 12.5.4 accessing corporate resources. KQL (Microsoft Defender / Intune): DeviceInfo | where OSVersion < "12.5.4" and OSPlatform == "iOS" — alert on any match.
  • MTD platform alerts: Filter Mobile Threat Defense events for categories "WebKit exploit", "malicious URL", and "drive-by download". Correlate with user identity and device ID in your SIEM to detect targeted delivery attempts.
  • DNS / proxy log anomaly: Flag iOS devices resolving or connecting to domains with freshly registered TLDs or no established reputation. Zeek pattern: dns.query matches /[a-z0-9]{12,}\.(xyz|top|tk|cf)$/ combined with a source IP belonging to the iOS device subnet.
  • Network beacon pattern: Short-interval, small-payload outbound connections from an iOS device immediately after a URL is opened suggest successful exploitation and C2 callback. Suricata: alert on unknown JA3 TLS fingerprints from iOS device IP ranges to non-categorised external IPs.
  • WebKit crash logs (supervised devices): Monitor Apple syslog / crash reports for repeated com.apple.WebKit.WebContent process crashes on supervised devices, especially when followed within seconds by a new outbound network connection — a classic heap-spray/UAF exploitation signature.

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
95.6 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
11.0 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2021-30762