Intel

CVE-2022-22620

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 16%

Description

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Source: REDHAT_CSAFCVELISTV5CISA_KEVNVDCVEORG

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2022-22620 carries a CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) and sits at the 96.7th EPSS percentile, placing it among the highest-probability-of-exploitation vulnerabilities across the entire CVE corpus. The attack requires only that a user visits a malicious webpage — no authentication, no elevated privileges, no complex preconditions on the attacker side. For NIS2-scoped organisations with BYOD policies or managed Apple fleets touching production or OT-adjacent systems, the blast radius is significant: every iOS browser uses WebKit, meaning there is no alternative engine to switch to as a compensating control. Apple's own advisory acknowledged active exploitation at the time of release, and the CISA KEV addition on 11 February 2022 confirms real-world weaponisation. Patch this within the CISA BOD 22-01 14-day window as a minimum; given the EPSS percentile and zero-click-from-browser attack surface, treating it as a 72-hour priority is justified for any organisation with internet-facing Apple devices.

Runbook · Step 1

Immediate response (0-24 h)

  • iOS/iPadOS: Force-update all managed devices to iOS 15.3.1 / iPadOS 15.3.1 immediately via MDM push (Jamf: softwareupdate --install --restart; Intune: OS compliance policy with minimum version 15.3.1). Unmanaged devices must self-update via Settings → General → Software Update.
  • macOS: Deploy macOS Monterey 12.2.1 via MDM or direct Software Update. Systems running macOS versions below Monterey receive no patch — escalate immediately to a risk decision: emergency upgrade or network isolation.
  • Safari: Update to Safari 15.3 (build 16612.4.9.1.8 or 15612.4.9.1.8) on all macOS endpoints. An unpatched Safari on an otherwise current macOS system remains exploitable.
  • Browser restriction: Until patch rollout is complete, block Safari and all WebKit-based browsers from accessing untrusted web content via proxy allowlist or MDM configuration profile. Note: on iOS, every browser (Chrome, Firefox, Edge) uses WebKit — there is no alternative engine to fall back on.
  • MDM compliance enforcement: Devices not reaching the target OS version within 24 hours should be quarantined — revoke VPN certificates, block Exchange ActiveSync, and move to a restricted VLAN via 802.1X policy or MDM compliance gate.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place managed Apple endpoints in a dedicated VLAN; route all outbound HTTP/HTTPS (TCP 80/443) through a TLS-inspecting proxy to intercept malicious WebKit payloads before they reach the browser engine.
  • DNS/Web content filtering: Block "Newly Registered Domains" and "Uncategorized" categories at the DNS or HTTP proxy layer (Cisco Umbrella, Zscaler, or equivalent). Exploit delivery for browser-based UAF vulnerabilities typically relies on attacker-controlled or freshly compromised domains.
  • IPS signature: Enable or create a rule targeting malformed HTML/JavaScript delivery aimed at WebKit heap manipulation — Snort/Suricata starting point: alert http any any -> $HOME_NET any (msg:"Possible WebKit UAF Exploit Delivery"; content:"<script"; pcre:"/use\s+after\s+free|uaf/i"; sid:9000001;) — tune to reduce false positives in your environment.
  • MDM Safari hardening: Use a com.apple.Safari configuration profile to disable JavaScript for untrusted zones and enforce "Fraudulent Website Warning." This reduces attack surface when a full patch cannot be deployed immediately.
  • Endpoint integrity controls: Ensure Gatekeeper and SIP (System Integrity Protection) remain enabled on all macOS systems. These controls limit post-exploitation persistence even if initial code execution succeeds.
  • CMDB risk tagging: Mark devices ineligible for iOS 15 (older iPhone models) as elevated-risk assets in your CMDB and physically or logically isolate them from corporate network resources.

Runbook · Step 3

Detection rules

  • MDM compliance telemetry: Alert on any Apple device reporting OS version below 15.3.1 (iOS/iPadOS) or 12.2.1 (macOS) — KQL (Intune/Defender): DeviceCompliancePolicyState | where ComplianceState == "noncompliant" and DeviceOS has "iOS" and OSVersion < "15.3.1".
  • Proxy/DNS logs: Correlate Apple device requests (User-Agent containing AppleWebKit) to domains registered within the last 30 days; flag POST requests carrying JavaScript payloads exceeding 500 KB as anomalous.
  • EDR process ancestry (macOS — Jamf Protect / CrowdStrike Falcon): Flag any process chain where Safari or com.apple.WebKit.WebContent spawns a shell or scripting interpreter — Sigma shape: process_creation | where ParentImage endswith "Safari" and Image in ("sh","bash","zsh","osascript","python3").
  • Crash log aggregation (macOS Unified Log): Repeated com.apple.WebKit.WebContent crash reports in /Library/Logs/DiagnosticReports/ are a pre-exploitation indicator — aggregate and alert on more than two WebContent crashes per device per hour.
  • Network telemetry (Zeek/Suricata): Flag outbound connections from Apple devices to unknown IPs initiated within 5 seconds of a WebKit process start, especially on non-standard ports or with JA3 fingerprints not associated with known applications — these are candidate C2 beacons.

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
96.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
16.3 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2022-22620