CVE-2021-30665

What it actually does

CVE-2021-30665 is a WebKit memory-corruption vulnerability in Apple platforms where maliciously crafted web content can corrupt process memory and cause arbitrary code execution in the context of the browser or web-rendering process. Exploitation requires a user or application to process attacker-controlled web content, such as visiting a malicious page, opening a link in an embedded web view, or previewing crafted content. Successful exploitation can allow code execution, data access within the process sandbox, and potentially serve as the first stage of a broader exploit chain when combined with sandbox escape, privilege escalation, or persistence vulnerabilities.

Why it matters to the business

Affected iPhone, iPad, Mac, Apple Watch, and Apple TV devices can be compromised through web content, creating risk of spyware deployment, credential and session theft, surveillance, data exposure, and operational disruption. Apple reported active exploitation, and the vulnerability is listed in CISA KEV with a remediation due date of 2021-11-17, so organizations should treat unpatched devices as high priority even though current EPSS is relatively low and stable. The broad use of WebKit across Apple browsers and embedded web views increases exposure because exploitation may occur through Safari, messages, email previews, or third-party apps that render web content.

How an attack unfolds

An attacker prepares web content that triggers the WebKit memory-corruption condition. The attacker then delivers a link, embedded webpage, redirect, advertisement, message, or other content that causes the target device to render the malicious page. When WebKit processes the crafted content, memory corruption occurs and the attacker gains code execution inside the web-rendering process. In real-world intrusion chains, this type of WebKit code execution is commonly paired with additional vulnerabilities to escape the browser sandbox, elevate privileges, access sensitive data, install spyware, or maintain control. Public reporting associated exploitation of Apple WebKit vulnerabilities in this period with commercial spyware activity, including Candiru/SOURGUM/DevilsTongue, so detection should consider targeted, low-noise exploitation rather than only broad scanning.

How to fix it

Upgrade affected Apple platforms to versions that contain the fix or later: iOS 14.5.1 or later, iPadOS 14.5.1 or later, iOS 12.5.3 or later for supported older devices, macOS Big Sur 11.3.1 or later, watchOS 7.4.1 or later, and tvOS 14.6 or later. Where possible, upgrade to the latest currently supported OS release rather than only the minimum fixed version, because related WebKit and kernel hardening fixes have shipped in later updates. For devices that cannot be upgraded, reduce exposure by restricting browsing to trusted sites, blocking known malicious domains and redirects, disabling unnecessary web content previews where manageable, isolating high-risk devices, and replacing unsupported hardware. Enterprise teams should enforce OS minimum versions through MDM compliance policies and quarantine or restrict access for noncompliant devices.

How to confirm the fix worked

Confirm the installed OS version on each affected device meets or exceeds the fixed versions: iOS/iPadOS 14.5.1, iOS 12.5.3 for eligible legacy devices, macOS Big Sur 11.3.1, watchOS 7.4.1, and tvOS 14.6. Validate through MDM inventory, Apple system update status, device compliance reports, or local checks such as About This Mac/System Settings on macOS and Settings > General > About on iOS/iPadOS. For macOS, confirm Safari/WebKit components are updated as part of the OS update and review software update receipts where available. Exposure remains if devices are below the fixed versions, are unsupported, or cannot receive security updates. After remediation, monitor for repeated WebKit process crashes or suspicious web-to-process activity that may indicate previous exploitation attempts.

Typical attack path

1. Identify a target using an affected Apple operating system version.
2. Deliver attacker-controlled web content through a malicious link, compromised website, redirect, advertisement, message, email, or embedded web view.
3. Cause Safari, WebKit, or another application using WebKit to process the crafted content.
4. Trigger memory corruption and execute attacker-controlled code in the web content process.
5. Optionally chain a sandbox escape or privilege escalation vulnerability to gain broader device access.
6. Collect sensitive data, tokens, messages, browsing data, or device metadata, or deploy surveillance tooling.
7. Remove or minimize artifacts to reduce forensic visibility.

How to detect it

Detection is difficult because successful WebKit exploitation may leave limited artifacts, especially on iOS and iPadOS, and sophisticated spyware operators may clean up traces. Use a combination of MDM inventory, endpoint telemetry, crash logs, network logs, DNS/proxy history, and mobile forensic artifacts. Look for vulnerable devices that accessed suspicious links, redirects, URL shorteners, newly registered domains, or unusual web infrastructure shortly before crashes of Safari, WebKit, or WebContent processes. On macOS, review Unified Logs, DiagnosticReports, CrashReporter data, browser history, EDR events, and child process behavior from Safari or WebKit-related processes. On iOS/iPadOS, collect sysdiagnose or mobile forensic backups where appropriate and review crash reports for repeated WebKit or WebContent crashes, especially EXC_BAD_ACCESS or memory-corruption style exceptions. Investigate any browser or WebKit process spawning unusual child processes, writing unexpected files, making connections to unfamiliar command-and-control infrastructure, or being followed by privilege-escalation indicators. Because Candiru/SOURGUM/DevilsTongue and similar commercial spyware activity has been associated with Apple WebKit exploitation, prioritize targeted users and anomalous low-volume infrastructure over commodity exploit-scanning patterns.

• com.apple.WebKit.WebContent
• com.apple.WebKit.Networking
• com.apple.Safari
• Safari
• WebKit
• WebContent
• EXC_BAD_ACCESS
• KERN_INVALID_ADDRESS
• SIGSEGV
• Segmentation fault
• memory corruption
• /Library/Logs/DiagnosticReports/
• ~/Library/Logs/DiagnosticReports/
• /Library/Logs/CrashReporter/
• ~/Library/Logs/CrashReporter/
• WebKit.WebContent_
• Safari_
• MobileSafari_
• JetsamEvent
• sysdiagnose
• DevilsTongue
• SOURGUM
• Candiru

What your security team should do

• Immediately identify all Apple devices running vulnerable iOS, iPadOS, macOS, watchOS, or tvOS versions and prioritize remediation of internet-facing, executive, administrator, developer, legal, journalist, activist, and other high-risk user devices.
• Enforce minimum OS versions through MDM: iOS/iPadOS 14.5.1 or later, iOS 12.5.3 or later for supported legacy devices, macOS Big Sur 11.3.1 or later, watchOS 7.4.1 or later, and tvOS 14.6 or later; preferably require the latest supported release.
• Treat this as actively exploited historical risk because it is in CISA KEV and Apple acknowledged in-the-wild exploitation; investigate unpatched devices that browsed suspicious links or experienced WebKit crashes before patching.
• Review network, proxy, DNS, EDR, MDM, and device telemetry for suspicious redirects, unknown domains, repeated WebKit crashes, and signs of spyware-like behavior around the time users interacted with links or web content.
• For high-risk users or devices that were vulnerable during the active exploitation window, consider deeper mobile forensic review, credential/session revocation, and re-enrollment or replacement if compromise cannot be ruled out.
• Block or investigate unsolicited links, URL shorteners, suspicious redirects, and newly registered domains targeting Apple users, especially where tied to high-value personnel.
• Retire Apple devices that cannot be updated to a supported security baseline.