Intel

CVE-2023-32435

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 23%

Description

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

Source: REDHAT_CSAFCISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2023-32435 carries a CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and sits at the 97.6th EPSS percentile, placing it among the highest-probability-of-exploitation vulnerabilities across the entire CVE corpus. Apple has explicitly acknowledged active exploitation against iOS versions prior to 15.7, indicating a threat actor with the capability and intent to weaponise browser-based memory corruption at scale. The attack requires only a single user interaction — clicking a link — making it highly effective as a spear-phishing payload against high-value targets such as executives or system administrators. For NIS2-scoped organisations, particularly those in sectors where mobile devices handle sensitive operational data, this vulnerability should be treated as a P1 incident: patch within 24 hours, document exceptions formally, and maintain heightened monitoring until the entire device fleet is confirmed compliant.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply vendor patches immediately: Update iOS/iPadOS to 16.4 or 15.7.7, macOS Ventura to 13.3, and Safari to 16.4. Push updates via MDM forced-update policy for managed devices; unmanaged devices must self-update via Settings > General > Software Update.
  • Isolate unpatched devices: Any iOS device that cannot reach 15.7.7 or 16.4 (e.g. hardware too old for iOS 15 support) must be removed from corporate network access or placed in a quarantine VLAN with no access to internal resources until replaced.
  • Block Safari and WebKit-based browsers on unpatched macOS: On macOS 13.0–13.2 systems that cannot be patched within the hour, disable Safari via MDM configuration profile and redirect users to a non-WebKit browser (Firefox, Chromium) as a temporary compensating control.
  • Verify Mobile Threat Defense coverage: Confirm that your MTD solution (e.g. Microsoft Defender for Endpoint on iOS, Jamf Protect) has up-to-date signatures and that exploit-detection modules are enabled across all enrolled devices.
  • Prioritise privileged users: Executives, IT administrators, and anyone with access to critical infrastructure systems receive Tier-1 patch priority — the browser-based attack vector makes them prime targets for spear-phishing delivery.
  • Initiate triage: Review MDM, MTD, and proxy logs for the past 30 days for anomalies matching the detection indicators below; if compromise is suspected, preserve a forensic image of the device before wiping.

Runbook · Step 2

Mitigation layers

  • Network segmentation — enforce proxy: Route all outbound HTTP/HTTPS traffic from iOS/macOS endpoints through a TLS-inspecting proxy on port 443; block direct connections to uncategorised or newly registered domains using threat-intelligence feeds.
  • DNS filtering: Enable malicious-domain blocking at the DNS resolver layer (e.g. Cisco Umbrella, Cloudflare Gateway); block categories "Newly Registered Domains" and "Malware" to reduce the likelihood of exploit-delivery pages being reachable.
  • WAF/IPS rule: Flag or throttle inbound responses containing unusually large or deeply nested HTML/JavaScript payloads (> 500 KB inline script, deeply nested DOM trees) at the perimeter WAF. Keep Suricata's "browser-webkit" signature category current.
  • MDM content filter profile: Deploy a Managed Content Filter profile via MDM (using the Network Extension API on iOS) to block known exploit-kit domains and suspicious URL patterns before the browser can load them.
  • Least-privilege for WebKit processes (macOS): Safari and WebKit helper processes run in a sandbox by default — audit any TCC overrides or entitlement exceptions (com.apple.security.app-sandbox) in third-party applications that embed WebKit, and remove unnecessary exceptions.
  • Formal exception process: Devices that cannot be patched immediately must be documented as risk-accepted exceptions (NIS2 Article 21 risk-management obligation) and assigned an elevated monitoring tier with a defined remediation deadline.

Runbook · Step 3

Detection rules

  • MDM compliance alert: Identify devices running iOS < 15.7.7 or < 16.4, macOS < 13.3, or Safari < 16.4 that remain active after the patch deadline. Automate as a daily compliance report. KQL (Intune/MDE): DeviceInfo | where OSVersion < "15.7.7" and OSPlatform == "iOS".
  • Proxy log — exploit-kit delivery pattern: Flag requests from iOS/macOS user-agents to domains registered fewer than 30 days ago where the response MIME type is text/html and body size exceeds 200 KB. SPL: index=proxy useragent="*iPhone*" OR useragent="*Macintosh*" response_size>204800 | stats count by dest_domain | where count < 3.
  • EDR/Sysmon — anomalous WebKit child process (macOS): Alert on any process spawned by com.apple.WebKit.WebContent or Safari where the child is a shell (sh, bash, zsh), a network utility (curl, wget), or a scripting runtime (osascript, python). This process-ancestry chain is a strong post-exploitation indicator.
  • MTD alert — exploit attempt: Monitor your MTD platform for alert types "Browser Exploit", "Memory Corruption Attempt", or "Privilege Escalation — WebKit"; pipe these directly into your SIEM/SOAR and trigger automatic device quarantine as a response action.
  • Network telemetry (Zeek): Flag TLS connections from iOS/macOS hosts to IP addresses with no reverse DNS entry on port 443 where the JA3 fingerprint does not match any known application baseline and the SNI extension is absent — a common characteristic of post-exploitation C2 beaconing.

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
97.6 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
22.8 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2023-32435