CVE-2021-30666

What it actually does

This is a WebKit memory-corruption vulnerability in Apple iPhone OS/iOS where maliciously crafted web content can trigger a buffer overflow during browser content processing. Successful exploitation can allow arbitrary code execution in the context of the web content process; attackers commonly chain this class of bug with sandbox escape or privilege-escalation vulnerabilities to gain broader device control, access sensitive data, or deploy spyware. The vulnerability is remotely reachable over the network but requires user interaction, such as opening a malicious link, visiting a compromised site, or rendering attacker-controlled content inside an embedded web view.

Why it matters to the business

An unpatched affected iPhone can be compromised simply through malicious web content viewed by a user, creating risk of data theft, surveillance, account compromise, and operational disruption for executives, administrators, journalists, legal teams, and other high-value mobile users. Apple reported active exploitation, CISA added the issue to the Known Exploited Vulnerabilities catalog with a remediation deadline of 2021-11-17, and public reporting associates exploitation of related Apple WebKit issues with commercial spyware activity such as Candiru/SOURGUM/DevilsTongue, making rapid remediation important even though the current EPSS score is relatively low and stable.

How an attack unfolds

An attacker prepares web content that exercises the vulnerable WebKit code path and causes a buffer overflow. The attacker then delivers the content through a link in SMS, email, messaging apps, a compromised website, advertising content, or any application that renders web content using Apple WebKit. When the target opens or previews the content, WebKit processes the malicious page and memory corruption occurs. If exploitation is reliable, attacker-controlled code runs inside the browser or web content process. In a limited attack this may steal data available to the browser context; in more serious campaigns it is chained with additional vulnerabilities to escape the WebKit sandbox, elevate privileges, install surveillance tooling, persist where possible, and communicate with command-and-control infrastructure. Because this issue was reported as actively exploited, organizations should assume targeted exploitation was feasible before patches were broadly applied.

How to fix it

Update affected Apple iPhone OS/iOS devices to iOS 12.5.3 or later supported Apple security releases that include the improved memory handling fix. Prioritize internet-facing and high-risk mobile users, including executives, administrators, developers, legal, finance, government-facing staff, and users likely to be targeted by spyware operators. Devices that cannot be updated to a fixed, supported version should be retired, isolated from sensitive workflows, or placed under compensating controls such as reduced access to corporate resources. Use MDM to enforce minimum OS versions, block enrollment or access from noncompliant devices, and require rapid installation of Apple security updates. Where immediate patching is not possible, reduce exposure by limiting use of unknown links, restricting unmanaged browsers or apps with embedded web views where feasible, using protective DNS/web filtering, and increasing monitoring of mobile device compliance and suspicious network activity.

How to confirm the fix worked

Confirm through MDM, device inventory, or Apple device management telemetry that all affected iPhone OS/iOS devices report iOS 12.5.3 or a later supported version containing the fix. Validate that compliance policies reject or quarantine devices below the required OS level. Spot-check high-risk users and legacy devices that may not receive automatic updates. Review Apple security update records for the installed build and verify the device is no longer on an affected release. For exposure assessment, search asset inventories for legacy iPhone models and older iOS 12.x installations, then confirm they have installed iOS 12.5.3 or have been removed from sensitive access.

Typical attack path

1. Identify users or devices likely to run an affected iOS/iPhone OS version.
2. Host or inject maliciously crafted web content that triggers the WebKit buffer overflow.
3. Deliver the content through phishing, SMS, messaging apps, malicious redirects, compromised websites, or embedded web views.
4. Wait for the user to open or render the attacker-controlled content.
5. Exploit memory corruption to execute code in the WebKit web content process.
6. Optionally chain a sandbox escape or privilege-escalation exploit to gain broader device access.
7. Collect browser-accessible data or deploy spyware/implant capabilities.
8. Establish outbound communications, exfiltrate data, and attempt to minimize visible crashes or user-facing symptoms.

How to detect it

Reliable confirmation of exploitation can be difficult because iOS provides limited endpoint telemetry and advanced spyware operators often minimize artifacts. Focus on evidence around the period before patching: Apple diagnostic and crash logs, MDM security telemetry, mobile threat defense alerts, DNS/proxy/firewall logs, secure web gateway logs, and EDR/NDR records for paired or managed devices. Look for repeated or unusual crashes in Safari, MobileSafari, or WebKit web content processes, especially EXC_BAD_ACCESS or KERN_INVALID_ADDRESS crashes involving WebKit, WebCore, or JavaScriptCore shortly after visiting unknown URLs. Correlate those events with suspicious SMS/email links, redirects, newly observed domains, short links, unexpected outbound connections, device battery/thermal anomalies, sudden configuration changes, or reports of browser instability. For high-risk users, consider mobile forensic acquisition using trusted tooling and review for signs of spyware tradecraft, suspicious profiles, abnormal persistence mechanisms, unexpected VPN/proxy settings, and connections to infrastructure associated with targeted surveillance campaigns such as Candiru/SOURGUM/DevilsTongue if available from threat intelligence feeds. Absence of these artifacts does not prove non-exploitation.

• MobileSafari
• com.apple.WebKit.WebContent
• com.apple.WebKit.Networking
• EXC_BAD_ACCESS
• KERN_INVALID_ADDRESS
• JavaScriptCore
• WebCore
• WebKit
• JetsamEvent
• Safari crash
• WebKit crash
• iOS 12.5.2
• iOS 12.5.1
• iOS 12.5
• iOS 12.4
• Candiru
• SOURGUM
• DevilsTongue

What your security team should do

• Treat this as a high-priority exploited mobile browser vulnerability because it is in CISA KEV and Apple reported active exploitation.
• Use MDM to enforce iOS 12.5.3 or later supported fixed releases and block corporate access from devices that cannot meet the minimum version.
• Prioritize remediation for high-value and high-risk users who are more likely to be targeted by spyware or phishing campaigns.
• Hunt for signs of pre-patch exploitation, especially WebKit/Safari crashes followed by unusual outbound network activity or abnormal mobile device behavior.
• Collect and preserve mobile crash logs and relevant network telemetry for devices that were exposed before patching, recognizing that iOS forensic visibility may be limited.
• Retire or segregate unsupported legacy devices that cannot receive the fixed Apple release.
• Educate users to report unexpected browser crashes, suspicious links, and unusual device behavior, but do not rely on user awareness as the primary control.
• Monitor threat intelligence for Candiru/SOURGUM/DevilsTongue infrastructure or campaign indicators that may overlap with mobile WebKit exploitation.