Intel

CVE-2023-32373

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 12%

Description

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Source: REDHAT_CSAFCISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2023-32373 carries a CVSS v3 score of 8.8 (AV:N/AC:L/PR:N/UI:R) and sits at the 96th EPSS percentile, placing it among the highest-probability exploitation targets across the entire CVE corpus. The attack requires only that a user opens a crafted web page — a condition easily achieved via phishing, malvertising, or a compromised legitimate site — making it highly accessible to a broad range of threat actors. For NIS2-scoped organisations with BYOD policies or managed Apple devices in production or OT-adjacent roles, the risk is amplified by the fact that WebKit is the only permitted browser engine on iOS/iPadOS, meaning every browser app on those platforms is affected. Apple's own confirmation of active exploitation before the patch release is the decisive factor: this warrants P1 treatment regardless of whether the CISA ransomware flag is set, as targeted spyware and credential-harvesting campaigns remain plausible use cases.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply Apple patches immediately: Update iOS/iPadOS to 15.7.6 or 16.5, macOS Ventura to 13.4, tvOS to 16.5, watchOS to 9.5, and Safari to 16.5 — deploy via Settings → General → Software Update or push through Apple Business Manager/MDM.
  • Audit managed Apple devices via MDM: Generate a compliance report and identify all devices still running iOS 15.7.5 / 16.4.x or earlier; quarantine non-compliant devices from the corporate network until patch status is confirmed.
  • Check Safari on macOS endpoints: Run a version check via MDM script or defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString — isolate or restrict browser access on any instance below 16.5.
  • Enforce managed-browser policy: Until full rollout is complete, restrict WebKit-based browsers (Safari and all iOS browsers) on unpatched devices to internal sites only; route external web traffic through a controlled proxy.
  • Triage recent activity: Review endpoint logs for unusual process spawns from WebKit processes (e.g. com.apple.WebKit.WebContent) over the past 14 days — this window covers the known exploitation period before KEV listing.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Move unpatched Apple endpoints into a quarantine VLAN; restrict outbound connections to approved destinations (internal resources, Apple update servers) until patching is complete.
  • Web proxy / content filtering: Route all HTTP/HTTPS traffic from iOS/macOS devices through a TLS-inspecting proxy (e.g. Zscaler, Squid with SSL-Bump); block known malvertising and drive-by domains using threat-intelligence feeds.
  • Enable IPS signatures: Activate Suricata/Snort signatures covering WebKit use-after-free exploits — Emerging Threats and Cisco Talos feeds have included relevant rules since May 2023; keep rulesets current.
  • Restrict JavaScript execution: On managed macOS devices, deploy a configuration profile (.mobileconfig) to disable JavaScript in Safari for untrusted zones — treat this as an emergency measure given the significant usability impact.
  • Enforce MDM attestation: Use Apple Managed Device Attestation (iOS 16+) to automatically block non-compliant devices from corporate VPN and email access until they report a patched WebKit version.
  • Preserve WebKit sandbox integrity: On macOS Ventura, confirm that sandbox profiles for com.apple.WebKit.WebContent are active and that no System Integrity Protection (SIP) exceptions have been granted.

Runbook · Step 3

Detection rules

  • Process anomaly (macOS endpoint): Unexpected child processes spawned by com.apple.WebKit.WebContent or Safari — such as bash, sh, python3, curl, or osascript — are a strong exploitation indicator. Sample KQL: DeviceProcessEvents | where InitiatingProcessFileName has "WebContent" and FileName in ("bash","sh","python3","curl","osascript").
  • Sysmon/EDR — memory artefacts: On macOS, use osquery to detect unusual dylib loads inside WebKit processes: SELECT * FROM process_open_files WHERE pid IN (SELECT pid FROM processes WHERE name LIKE '%WebContent%') AND path NOT LIKE '/System/%' AND path NOT LIKE '/usr/%'.
  • Network telemetry (Zeek/Suricata): Correlate HTTP responses with unusually large HTML payloads (> 500 KB) followed within 60 seconds by an outbound connection from the same endpoint to an unknown external IP — build a SIEM correlation rule for this pattern.
  • Unified Log (macOS): Stream crashes with log stream --predicate 'process == "com.apple.WebKit.WebContent" AND eventMessage CONTAINS "crash"' — repeated WebContent process crashes (> 3 per hour per device) may indicate failed or successful exploit attempts; alert accordingly.
  • MDM compliance alert: Configure an automated alert for any device that still reports a WebKit version below the target versions after the patch deadline (e.g. 72 hours post-MDM push) — data sources: Apple Business Manager, Jamf, or Microsoft Intune compliance reports.

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
95.9 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
12.2 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2023-32373