CVE-2021-30663

What it actually does

CVE-2021-30663 is a WebKit memory-corruption vulnerability caused by an integer overflow that can occur while processing maliciously crafted web content. Because WebKit is used by Safari and embedded web views across affected Apple platforms, successful exploitation can allow an attacker-controlled web page or web-delivered payload to execute arbitrary code in the context of the browser or web content process. The CVSS vector indicates network-based exploitation with low attack complexity, no authentication requirement, and user interaction required, with high confidentiality, integrity, and availability impact.

Why it matters to the business

An attacker can compromise Apple devices when a user visits or is redirected to malicious web content, potentially enabling spyware deployment, data theft, account compromise, surveillance, or follow-on access to business applications used from the device. This vulnerability is listed in CISA KEV, has documented exploitation in the wild, and was associated with commercial spyware activity, making unpatched internet-browsing Apple devices a high-priority operational risk even though the EPSS score is relatively low and stable.

How an attack unfolds

An attacker prepares web content that triggers the WebKit integer overflow and causes memory corruption during parsing or rendering. The target is lured to the content through a malicious link, compromised website, watering-hole page, advertisement, message, email, or embedded web view. When Safari or another app using WebKit processes the content, the crafted input corrupts memory in a controlled way, allowing the attacker to divert execution flow and run code within the WebKit process. In real-world campaigns, exploitation may be chained with sandbox escape, privilege escalation, or persistence techniques to move from browser code execution to broader device compromise. Public reporting has associated exploitation of this class of Apple WebKit vulnerabilities with Candiru / SOURGUM / DevilsTongue spyware activity.

How to fix it

Upgrade affected Apple products to fixed or later releases: iOS 14.5.1 or later, iPadOS 14.5.1 or later, iOS 12.5.3 or later for supported older devices, macOS Big Sur 11.3.1 or later, Safari 14.1.1 or later, and tvOS 14.6 or later. Where possible, move devices to currently supported Apple OS versions that continue to receive security updates. If immediate patching is not possible, reduce exposure by restricting access to unknown or untrusted websites, disabling or limiting high-risk web content where operationally feasible, using managed browser controls, filtering known malicious domains, and prioritizing patching for users at elevated risk such as executives, administrators, legal, finance, journalists, and personnel likely to be targeted by spyware operators.

How to confirm the fix worked

Confirm remediation by inventorying Apple OS and Safari versions and verifying they meet or exceed the fixed versions: iOS/iPadOS 14.5.1, iOS 12.5.3, macOS Big Sur 11.3.1, Safari 14.1.1, and tvOS 14.6. On macOS, validate via system update status and Safari version reporting; on managed iOS/iPadOS/tvOS devices, validate through MDM device inventory and compliance policies. Confirm that unsupported Apple devices are either upgraded to supported releases, isolated, or retired. Test representative devices by confirming no pending Apple security updates remain and that browser/web-view applications are using the patched WebKit framework supplied by the OS or Safari update.

Typical attack path

1. Identify targets using affected Apple platforms or Safari/WebKit versions.
2. Deliver a link or web-delivered payload through phishing, messaging, compromised websites, malvertising, or watering-hole infrastructure.
3. Cause the victim to open or automatically render malicious web content in Safari or an application using WebKit.
4. Trigger the integer overflow during WebKit content processing, resulting in memory corruption.
5. Execute attacker-controlled code in the browser or web content process.
6. Optionally chain with additional vulnerabilities to escape sandboxing, elevate privileges, install spyware, access sensitive data, or maintain persistence.
7. Exfiltrate data, monitor user activity, or use the compromised device for follow-on operations.

How to detect it

There are no reliable universal indicators for exploitation of this vulnerability because WebKit exploit delivery is often transient, payloads are customized, and successful spyware-style attacks may leave limited logs. Hunt retrospectively using multiple sources: Apple Unified Logs, Safari and WebKit crash reports, panic and jetsam logs, MDM security telemetry, EDR events on macOS, DNS logs, proxy or secure web gateway logs, email and messaging link-click telemetry, and network egress records. Look for Safari or WebKit crashes occurring immediately after visits to suspicious, newly registered, uncategorized, or targeted domains; repeated crashes of WebKit web content processes; unexpected child processes or file writes from browser-related processes on macOS; installation of unknown configuration profiles; unexpected VPN, MDM, certificate, or accessibility changes; unusual outbound connections after browser crashes; and signs of mobile spyware behavior such as abnormal background network traffic or device management changes. For high-risk users, correlate web access followed by process crashes, security setting changes, or unexplained device instability. If Candiru / SOURGUM / DevilsTongue activity is suspected, prioritize forensic preservation and vendor-assisted mobile analysis because public, stable, CVE-specific IOCs are limited.

What your security team should do

• Treat this as urgent for any remaining unpatched Apple devices because it is in CISA KEV, has known in-the-wild exploitation, and the KEV remediation deadline of 2021-11-17 has long passed.
• Use MDM or endpoint inventory to identify all affected macOS, iOS, iPadOS, tvOS, and Safari installations and prioritize remediation of internet-facing, executive, administrator, and high-risk user devices.
• Upgrade to fixed or currently supported Apple releases rather than relying solely on compensating controls.
• Hunt for signs of prior exploitation on high-risk devices, focusing on Safari/WebKit crashes, suspicious redirects, unknown configuration profiles, unusual persistence artifacts, and spyware-like behavior.
• Review web proxy, DNS, secure web gateway, EDR, and MDM telemetry for suspicious browsing immediately preceding device crashes or anomalous process behavior.
• If exploitation is suspected on mobile devices, preserve device logs and consider specialist mobile forensic acquisition because commodity endpoint telemetry may not capture WebKit exploit chains reliably.
• Block or investigate newly observed domains and URLs involved in targeted delivery, phishing, watering-hole, or malvertising activity, but do not rely on domain blocking as a substitute for patching.