CVE-2021-30761

What it actually does

CVE-2021-30761 is a WebKit memory corruption vulnerability affecting Apple iPhone OS/iOS. When a vulnerable device processes maliciously crafted web content, memory state can be corrupted in a way that allows attacker-controlled code to execute. Exploitation requires user interaction, such as visiting a malicious page or opening content that renders through WebKit, but does not require authentication or prior device access. Successful exploitation can compromise confidentiality, integrity, and availability, and may be combined with sandbox escape or privilege escalation vulnerabilities to achieve broader device control.

Why it matters to the business

A successful exploit can allow attackers to compromise iPhones through malicious web content, enabling surveillance, data theft, account compromise, or follow-on malware deployment. Because this vulnerability is in CISA KEV, has documented active exploitation, and had a CISA remediation deadline of 2021-11-17, unpatched legacy devices should be treated as high-risk even though the vulnerability is old. Organizations that still allow affected iOS versions may face operational disruption, exposure of sensitive communications, and elevated risk from commercial spyware or targeted intrusion campaigns.

How an attack unfolds

An attacker prepares web content that triggers the WebKit memory corruption condition. The attacker then delivers that content through a link, redirect, compromised website, embedded browser view, message, email, or another application that causes WebKit to render the payload. When the vulnerable device processes the content, the memory corruption is triggered and attacker code can execute in the context of the WebKit web content process. In real-world campaigns, including activity associated with commercial spyware vendors such as Candiru/SOURGUM/DevilsTongue, this type of browser exploit is commonly chained with additional vulnerabilities to escape the browser sandbox, elevate privileges, collect device data, and establish monitoring or command-and-control capability. Exploitation may leave few obvious user-visible signs beyond browser crashes, unusual battery or network behavior, or mobile threat defense alerts.

How to fix it

Update affected devices to iOS 12.5.4 or later. For devices that cannot be upgraded to a fixed iOS release, remove them from enterprise use or restrict them from accessing sensitive services. Apply Apple security updates across all supported iOS/iPadOS/macOS devices because WebKit vulnerabilities can affect multiple Apple products and all browsers on iOS rely on WebKit. As interim risk reduction, limit exposure to untrusted web content, block known malicious domains and redirects, use mobile threat defense where available, and enforce MDM compliance rules that prevent outdated iOS versions from accessing organizational resources.

How to confirm the fix worked

Confirm through MDM, device inventory, or local device settings that all affected iPhones are running iOS 12.5.4 or later. Validate that compliance policies quarantine or block devices below the fixed version. Review vulnerability management and mobile device management reports for any remaining devices on iOS versions earlier than 12.5.4. Where network controls are used, test that outdated devices cannot access sensitive applications. For forensic validation, review device crash diagnostics and mobile threat defense telemetry for WebKit or Safari crashes and suspicious web redirects before the upgrade date.

Typical attack path

1. Identify targets using vulnerable iOS/iPhone OS versions prior to the fixed release.
2. Create or obtain malicious web content that triggers the WebKit memory corruption flaw.
3. Deliver the content through a malicious link, redirect, compromised site, message, email, or in-app web view.
4. Wait for the user or application to render the malicious content through WebKit.
5. Achieve arbitrary code execution in the WebKit web content process.
6. Optionally chain with sandbox escape or privilege escalation exploits to gain broader device access.
7. Collect data, deploy spyware capabilities, establish command-and-control, or perform additional post-exploitation activity.

How to detect it

To assess prior exploitation, correlate mobile device inventory with web, DNS, proxy, MDM, and mobile threat defense telemetry for the period before devices were upgraded. Focus on devices running iOS versions earlier than 12.5.4 that show Safari, WebKit, or in-app browser crashes shortly after visiting unusual domains, redirects, shortened links, or newly observed infrastructure. Review iOS crash diagnostics for repeated crashes of WebKit-related processes, especially around suspicious browsing events. Inspect MDM and device security telemetry for unexpected configuration profiles, certificates, VPN settings, managed app changes, jailbreak indicators, abnormal battery drain, unusual outbound connections, or mobile threat defense spyware alerts. Where available, compare network destinations against threat intelligence for Candiru/SOURGUM/DevilsTongue and commercial spyware infrastructure. Absence of logs is not proof of non-exploitation because mobile browser exploitation and spyware delivery often leave limited artifacts.

• iOS version earlier than 12.5.4
• MobileSafari
• com.apple.WebKit.WebContent
• WebKit
• WebContent
• /private/var/mobile/Library/Logs/CrashReporter/
• JetsamEvent
• LowMemory
• unexpected configuration profile
• unknown configuration profile
• untrusted root certificate
• unknown VPN configuration
• Candiru
• SOURGUM
• DevilsTongue

What your security team should do

• Prioritize immediate identification and removal or upgrade of any iPhones running iOS versions earlier than 12.5.4.
• Treat vulnerable legacy devices as high-risk because this issue is KEV-listed and known to have been exploited in the wild.
• Enforce MDM compliance policies that block outdated iOS versions from email, messaging, identity, VPN, and sensitive business applications.
• Review historical telemetry for WebKit, Safari, and in-app browser crashes followed by unusual network activity or device behavior.
• Use mobile threat defense, DNS, proxy, and EDR-like mobile telemetry to investigate suspicious redirects, spyware indicators, and unknown configuration profiles.
• Retire unsupported devices that cannot receive the fixed release.
• Educate users that links in messages, emails, and web pages can be used to compromise mobile devices, especially when devices are not updated.