Intel

CVE-2022-48503

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 3.2%

Description

The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.

Source: REDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFCISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2022-48503 is a memory-corruption RCE in JavaScriptCore triggered solely by visiting a malicious web page — no authentication required, network-reachable, user interaction limited to a single click (CVSS AV:N/AC:L/PR:N/UI:R, score 8.8). The EPSS value at the 87th percentile indicates a high likelihood of active exploitation tooling being available, making this particularly urgent for organisations with significant macOS or iOS footprints — common in media, creative industries, and financial services. CISA's KEV addition in October 2025 suggests ongoing targeting of devices that remain unpatched or have reached end of life; EoL devices should be treated as an unacceptable residual risk under NIS2 obligations. No ransomware campaign association is flagged by CISA, but the full C:H/I:H/A:H impact triad is sufficient for credential theft and lateral movement, warranting high-priority remediation regardless.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply vendor patches immediately: Update all affected Apple devices to the fixed versions — macOS Monterey 12.5, iOS/iPadOS 15.6, tvOS 15.6, watchOS 8.7, Safari 15.6. Distribute via System Preferences → Software Update or Apple Business Manager/MDM.
  • Identify and isolate end-of-life devices: Devices that cannot reach the target OS versions (e.g. older iPhones without iOS 15 support) must be removed from the corporate network or placed in a strictly filtered quarantine VLAN immediately.
  • Disable Safari on unpatched macOS endpoints: Push an MDM configuration profile to block Safari and enforce an alternative browser (e.g. Firefox ESR, Chrome) as a bridge measure — the vulnerability resides in JavaScriptCore, which Safari calls directly.
  • Run a managed-device compliance report: Use your MDM platform (Jamf, Microsoft Intune, Apple Business Manager) to generate an immediate inventory of all Apple endpoints and flag any device below the patch threshold as non-compliant.
  • Restrict web browsing on unpatched devices: Tighten web proxy policies — block categories such as "Newly Registered Domains" and "Uncategorized" to reduce the drive-by exploitation surface until patching is complete.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Move unpatched Apple devices into a quarantine VLAN; restrict outbound traffic to known, categorised destinations and block direct internet browsing paths that bypass proxy inspection.
  • Web proxy / content filtering: Enable TLS inspection on the proxy (subject to applicable privacy regulations) and block JavaScript delivery from unknown or newly registered domains. Set proxy policy categories "Malware", "Phishing", and "Newly Registered Domains" to block.
  • WAF/IPS rules: Activate JavaScriptCore heap-exploit signatures on your perimeter IPS — Emerging Threats Suricata/Snort rulesets include generic JS-engine exploit signatures; update to the latest ruleset and verify alert coverage.
  • MDM compliance enforcement: Configure an MDM compliance policy that automatically revokes network access (Wi-Fi profile, VPN certificate) for devices below the minimum OS version until the update is confirmed.
  • Least privilege — remove local admin rights: Ensure macOS end users do not hold local administrator privileges. A successful JavaScriptCore RCE runs in the context of the logged-in user; removing admin rights limits post-exploitation options such as persistence via LaunchAgents and Keychain access.
  • BYOD devices: Block unmanaged Apple devices from accessing internal resources via NAC or a Zero Trust gateway until patch status can be verified.

Runbook · Step 3

Detection rules

  • EDR — suspicious child processes from Safari/WebContent: Alert when com.apple.WebKit.WebContent or Safari spawns processes such as bash, sh, python, osascript, curl, or launchctl. EDR query (CrowdStrike Falcon / SentinelOne): parent image contains WebContent AND child image in [bash, sh, zsh, python3, osascript, curl].
  • Endpoint — LaunchAgent/LaunchDaemon persistence: Monitor for new .plist files written to ~/Library/LaunchAgents/, /Library/LaunchAgents/, or /Library/LaunchDaemons/ following browser activity. Correlate with macOS Unified Log entries: subsystem:com.apple.launchd showing new job registrations.
  • Network telemetry (Zeek/Suricata): Flag unusual outbound connections from macOS hosts shortly after HTTP/HTTPS requests to unknown domains — especially connections on non-standard ports (not 80/443) or to recently registered IPs. Zeek filter: conn.log where orig_bytes > 0 and resp_p !in {80, 443, 8080} from hosts with Safari user-agent strings.
  • Sigma rule (shape): 
    title: Suspicious Child Process from macOS WebContent
logsource: category=process_creation, product=macos
detection:
  selection:
    ParentImage|contains: 'WebContent'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/osascript'
      - '/curl'
  condition: selection
  • Proxy log analysis: HTTP responses with content-type text/html or application/javascript from domains younger than 30 days delivered to Apple devices — SPL: index=proxy dest_category="new_domain" useragent="*Safari*" http_content_type IN ("text/html","application/javascript") | stats count by src_ip, dest.

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
87.4 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
3.2 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2022-48503
Red Hat Security Advisory: webkitgtk4 security update — CVE-2022-48503 | NEOSEC Intel