Intel

CVE-2021-30952

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 7%

Description

An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

Source: REDHAT_CSAFCISA_KEVCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2021-30952 is an integer overflow in WebKit, the browser engine that Apple mandates across all its platforms — meaning every browser on iOS and iPadOS is affected, not just Safari. The EPSS percentile of 93.7 % signals that this vulnerability ranks among the most likely to be exploited relative to all known CVEs, making the moderate raw score misleading as a standalone metric. CISA's addition to the KEV catalogue in March 2026 confirms active exploitation. For NIS2-scoped organisations with significant Apple device footprints — particularly those using iOS in field operations or Apple TV in control-room or boardroom environments — the attack surface is broad and the user-interaction barrier (simply visiting a malicious page) is low. Patch deployment via MDM is the highest-priority action; unmanaged devices represent the residual risk that must be tracked manually until remediated.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply vendor patches immediately: Update all affected Apple platforms to iOS/iPadOS 15.2, macOS Monterey 12.1, tvOS 15.2, watchOS 8.3, and Safari 15.2. Push updates via MDM to all managed devices and escalate unmanaged devices directly to end users.
  • Enforce MDM compliance policy: Configure Apple Business Manager / Jamf / Intune to require the minimum OS version; block non-compliant devices from corporate resources (VPN, Exchange ActiveSync, 802.1X Wi-Fi) until the update is confirmed.
  • Disable Safari on unpatched devices where possible: On macOS, replace Safari with a non-WebKit browser as the default until patching is complete. Note: on iOS/iPadOS, all browsers use WebKit — isolation and patching are the only effective controls.
  • Inventory Apple TV and watchOS devices: Identify KRITIS-relevant Apple TV units used in control rooms or presentation systems and prioritise patching or network isolation.
  • Initiate threat hunt on macOS endpoints: Query your EDR for unusual child processes spawned by com.apple.WebKit.WebContent over the past 30 days to identify potential prior exploitation.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Move unmanaged Apple (BYOD) devices into a dedicated VLAN with restrictive outbound policy; route all web traffic through a TLS-inspecting proxy.
  • DNS and web proxy filtering: Block "Newly Registered Domains" and "Malware Distribution" categories at the proxy/DNS resolver — WebKit exploit delivery typically relies on freshly registered or compromised domains.
  • IPS signature activation: Enable available WebKit integer-overflow exploit signatures on perimeter IPS (check Emerging Threats ruleset for CVE-2021-30952 coverage; apply relevant Snort/Suricata community rules).
  • Least-privilege for browser processes (macOS): Ensure Safari runs under a standard (non-admin) user account; verify that System Integrity Protection (SIP) and Gatekeeper are enabled on all macOS endpoints.
  • Conditional access via MAM: Use Microsoft Entra ID Conditional Access or Jamf Compliance Engine to block corporate app and data access from devices reporting iOS/iPadOS below 15.2.
  • User awareness notice: Issue a short advisory warning staff not to open unsolicited web links — WebKit exploits are commonly delivered via crafted URLs in phishing emails or messaging apps.

Runbook · Step 3

Detection rules

  • macOS endpoint (EDR/Sysmon for macOS): Alert on process ancestry Safari → com.apple.WebKit.WebContent → unexpected child process (e.g. sh, bash, curl, python3). Sigma shape: parentImage|endswith: 'WebContent' AND image|endswith: ('sh','bash','curl','python3').
  • macOS Unified Log / auditd: Look for execve calls originating from the WebKit sandbox process (com.apple.WebKit.WebContent) — search Unified Log for subsystem: com.apple.sandbox with action: deny immediately followed by successful exec events.
  • Network telemetry (Zeek/Suricata): Flag HTTP/HTTPS connections from Apple devices to short-TTL domains (<60 s) delivering unusually large JavaScript payloads (>500 KB in a single response body) as potential exploit staging.
  • MDM compliance log (Sentinel KQL): DeviceCompliancePolicyStates | where ComplianceState != "Compliant" and OSVersion < "15.2" — escalate as open risk ticket for any device still reporting a vulnerable OS version after the patch deadline.
  • Proxy log (Splunk SPL): index=proxy sourcetype=bluecoat OR squid uri_path="*.js" bytes_out>500000 | stats count by src_ip, dest_host | where count > 3 — repeated large JavaScript fetches from a single Apple device may indicate exploit payload retrieval.

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
93.7 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
7.0 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2021-30952