Intel

CVE-2022-32893

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 9.9%

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Source: REDHAT_CSAFCISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2022-32893 is an out-of-bounds write in WebKit that enables remote code execution with no authentication required and only a single user interaction — visiting a crafted web page. The CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R) combined with an EPSS percentile of 95.3 % places this firmly in the highest-priority remediation tier. Apple's own advisory acknowledged active exploitation at the time of release, a pattern historically associated with targeted attacks against high-value individuals such as executives, journalists, and operators of critical infrastructure. For NIS2-scoped organisations running managed Apple fleets or permitting BYOD access to internal systems, this vulnerability should be treated as critical; the CISA KEV entry date of 18 August 2022 mandated remediation within 14 days for US federal agencies — KRITIS operators should adopt the same window as a benchmark. The absence of a CISA ransomware-campaign flag suggests the primary risk is targeted device compromise rather than opportunistic mass exploitation, but the low attack complexity means that risk can shift quickly.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch now: Update all Apple devices to iOS/iPadOS 15.6.1 and macOS Monterey 12.5.1 — these releases contain the fix for CVE-2022-32893. Update Safari to 15.6.1 (available as a standalone update for macOS Big Sur and Catalina as well).
  • Enforce via MDM: Use Apple Business Manager, Jamf, or Intune to push a mandatory update policy and verify patch compliance across all managed iOS and macOS endpoints within 4 hours.
  • Quarantine unmanaged BYOD devices: Any device without MDM enrollment that accesses internal resources (VPN, Exchange, SharePoint) should be blocked from those resources until patch status is confirmed.
  • Update WebKit on Linux hosts: Fedora and Debian packages for WebKit2GTK were released shortly after the Apple advisory — run dnf update webkit2gtk3 or apt-get upgrade libwebkit2gtk-4.0-37 on affected systems.
  • Feed threat intelligence: Ingest any IOCs published in Apple Security Advisory APPLE-SA-2022-08-17 into your SIEM and proxy blocklists immediately.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place mobile endpoints in a dedicated MDM VLAN; route all outbound web traffic from iOS/macOS devices through a TLS-inspecting proxy (e.g. Zscaler, Squid with SSL-Bump) to filter malicious web content before it reaches the device.
  • WAF/proxy rule: Block or flag requests with abnormally large or malformed HTML/JavaScript payloads — write a Snort/Suricata rule targeting anomalous Content-Length headers and deeply nested <script> tags containing Base64 blobs.
  • Temporarily replace Safari: On managed Macs, disable Safari and set Firefox or Chrome as the default browser — both use non-WebKit rendering engines (Gecko/Blink) and are unaffected by this specific vulnerability.
  • Least privilege and sandboxing: Confirm that Safari and WebKit-based apps run without elevated privileges; keep macOS System Integrity Protection (SIP) and Gatekeeper enabled to limit post-exploitation lateral movement.
  • Email gateway hardening: Rewrite URLs in inbound email and pre-render them through a sandboxing service (e.g. Microsoft Defender Safe Links, Proofpoint URL Defense) to break drive-by delivery chains before the user clicks.

Runbook · Step 3

Detection rules

  • Proxy/web filter logs: Safari/WebKit User-Agent strings accessing newly registered domains (< 30 days old) — SPL: index=proxy useragent="*Safari*" NOT useragent="*Chrome*" NOT useragent="*Firefox*" | where domain_age_days < 30
  • EDR process tree (macOS): Child processes of com.apple.WebKit.WebContent or SafariForWebKitDevelopment spawning shell interpreters (sh, bash, zsh, python3) or network tools (curl, nc) — Sigma shape: ParentImage|endswith: 'WebContent' AND Image|endswith: ('sh','bash','curl','nc')
  • macOS Endpoint Security Framework: Monitor ES_EVENT_TYPE_NOTIFY_EXEC events where the parent process is a WebKit process and the child is outside expected WebKit binary paths — configurable as a custom rule in Jamf Protect or SentinelOne.
  • Auditd (Linux/Fedora/Debian): Catch execve syscalls whose parent PID belongs to a WebKit2GTK process (Web Content, WPEWebProcess) and whose child binary path falls outside /usr/lib/webkit2gtk* — auditd rule: -a always,exit -F arch=b64 -S execve -F ppid=<webkit_pid> -k webkit_exec_anomaly
  • Network telemetry (Zeek/Suricata): Outbound connections from managed endpoints to unknown IPs on non-standard ports (not 80/443) occurring within seconds of loading an external web page — Zeek: conn.log | where id.orig_h in managed_device_list AND NOT id.resp_p in {80,443} AND duration < 5s

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
95.3 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
9.9 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2022-32893