Intel

CVE-2022-42856

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 8.5%

Description

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..

Source: REDHAT_CSAFCISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2022-42856 carries a CVSS 3.1 score of 8.8 (network-accessible, no privileges required, single user interaction via a malicious web page) and sits at the 94.8th EPSS percentile, indicating a statistically very high probability of active exploitation tooling in circulation. Apple's own advisory confirms exploitation against iOS versions prior to 15.1, pointing to targeted campaigns against devices that may no longer receive updates — a realistic scenario in organisations with long device refresh cycles. For NIS2-scoped and KRITIS organisations, the critical risk vector is a compromised mobile device that holds VPN credentials, MFA tokens, or access to internal portals, which can serve as a pivot point into otherwise segmented infrastructure. CISA has not flagged ransomware use, but arbitrary code execution on a device with enterprise access warrants critical internal severity regardless of that flag.

Runbook · Step 1

Immediate response (0-24 h)

  • iOS/iPadOS: Force-update all managed devices to iOS 15.7.2 or iOS 16.1.2 immediately via Settings → General → Software Update. Devices running iOS < 15.1 are explicitly called out by Apple as having been actively targeted — treat these as highest priority.
  • macOS: Apply macOS Ventura 13.1 and update Safari to version 16.2. If Safari is used on older macOS versions, verify whether Apple has backported the Safari 16.2 update and apply it accordingly.
  • tvOS: Push tvOS 16.2 to all managed Apple TV devices, particularly those used in meeting rooms or presentation environments with access to internal networks.
  • MDM enforcement: Configure a compliance policy in your MDM platform (Jamf, Microsoft Intune, or equivalent) to immediately revoke Wi-Fi profiles and VPN certificates from any iOS/iPadOS device that does not report the patched OS version, blocking network access until remediated.
  • Lockdown Mode for high-risk users: Enable Apple Lockdown Mode for executives, IT administrators, and personnel with privileged access to OT/KRITIS systems — this significantly restricts WebKit attack surface as an immediate compensating control.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place BYOD and corporate mobile devices in a dedicated VLAN with restricted east-west access. Route all outbound web traffic through a proxy with TLS inspection to detect malicious web content delivery.
  • DNS filtering: Configure enterprise DNS resolvers (e.g. Cisco Umbrella, Infoblox) with threat intelligence feeds; enable blocking for "Newly Registered Domains" and "Malware" categories to cut off exploit-staging infrastructure.
  • Proxy/IPS rule: Inspect outbound HTTPS from mobile devices for suspicious JavaScript payloads — Suricata rule targeting anomalous ArrayBuffer or TypedArray manipulation patterns in WebKit exploit chains; alert on JavaScript files > 500 KB served from low-reputation domains to iOS User-Agents.
  • MDM configuration profile — disable JavaScript: As a hard compensating control where patching is delayed, push a Safari configuration profile via MDM that disables JavaScript or restricts it to an allowlisted set of internal domains.
  • Least privilege / app permissions: Audit and restrict Safari and WebKit-based in-app browser permissions (camera, microphone, contacts, location) to the operational minimum — limits post-exploitation lateral capability on a compromised device.

Runbook · Step 3

Detection rules

  • MDM compliance log: Alert on any managed iOS/iPadOS device reporting OS version below 15.7.2 or 16.1.2 — KQL (MDE/Intune): DeviceInfo | where OSPlatform == "iOS" and OSVersion < "15.7.2".
  • Proxy/DNS log: Flag requests from iOS User-Agents to domains registered within the last 30 days that serve JavaScript files larger than 500 KB — SPL: index=proxy useragent="*iPhone*" OR useragent="*iPad*" url_length>500 | stats count by dest_host.
  • EDR process ancestry (macOS): Using Jamf Protect or Sysmon for macOS, alert on the process chain Safari → WebContent → unexpected child process spawning outside /Applications/Safari.app — this is a strong post-exploitation indicator.
  • Network telemetry (Zeek/Suricata): Detect iOS devices (identified by User-Agent) establishing TLS sessions to IPs with no reverse DNS on port 443 with session duration < 5 seconds, followed within 60 seconds by a new outbound connection to a second unknown IP — consistent with exploit staging and C2 beacon patterns.
  • Crash reports as pre-exploitation indicator: On devices managed with Jamf Protect or a comparable agent, correlate WebContent process crash reports (ReportCrash, exception type EXC_BAD_ACCESS or EXC_CRASH) — a cluster of crashes on the same device shortly before a suspicious outbound connection is an early warning signal for exploitation attempts.

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
94.7 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
8.5 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2022-42856