CVE-2021-30762

What it actually does

CVE-2021-30762 is a WebKit use-after-free memory corruption vulnerability affecting Apple iPhone OS/iOS. When a vulnerable device processes maliciously crafted web content, the browser/WebKit rendering process can dereference memory after it has been freed, allowing an attacker to corrupt process memory and execute arbitrary code in the context of the web content process. Because exploitation requires only that a user interact with attacker-controlled web content, the vulnerability is remotely reachable over the network and does not require prior authentication. Apple reported active exploitation in the wild, and the issue is listed in CISA KEV with a remediation due date of 2021-11-17.

Why it matters to the business

Successful exploitation can compromise vulnerable iPhones by allowing attacker-supplied code to run after a user visits or previews malicious web content. This can lead to device compromise, surveillance, data theft, credential exposure, or follow-on exploitation when chained with sandbox escape or privilege escalation vulnerabilities. The business risk is elevated because the flaw was exploited in the wild, appears in CISA KEV, and has been associated with commercial spyware activity such as Candiru/SOURGUM/DevilsTongue. Organizations with unmanaged, legacy, or slow-to-update iOS devices face persistent exposure because the issue is several years old and known to attackers.

How an attack unfolds

An attacker prepares a malicious web page, advertisement, iframe, link, or other web-delivered content designed to trigger the WebKit use-after-free condition. The attacker then induces a target to open the content in Safari, an embedded web view, or another application using the vulnerable Apple web rendering stack. When the crafted content is parsed and rendered, WebKit mishandles object lifetime, accesses freed memory, and permits controlled memory corruption. With a reliable exploit, the attacker gains arbitrary code execution inside the browser or WebKit content process. In real-world campaigns, this type of vulnerability is commonly chained with additional sandbox escape, persistence, or privilege-escalation exploits to deploy spyware, collect sensitive information, or monitor the device. Reported exploitation context includes Candiru/SOURGUM/DevilsTongue activity and broader Apple WebKit memory corruption exploitation patterns.

How to fix it

Upgrade affected Apple iPhone OS/iOS devices to iOS 12.5.4 or later where applicable, or to the latest iOS version supported by the device. Because this vulnerability is in CISA KEV and was actively exploited, remediation should be treated as urgent for any device still running a vulnerable build. If a device cannot be upgraded to a fixed version, remove it from sensitive use, restrict access to corporate resources, disable or limit unmanaged browsing where possible, and replace the device with supported hardware. Enforce mobile device management controls requiring minimum OS versions, block jailbroken or noncompliant devices, and ensure Safari/WebKit-dependent applications are not allowed to process untrusted content on vulnerable systems.

How to confirm the fix worked

Confirm that all affected devices report iOS/iPhone OS version 12.5.4 or later, or a newer supported iOS release that includes the fix. Validate through MDM inventory, device compliance reports, Apple device settings, or endpoint telemetry. Review policy enforcement to ensure devices below the fixed version are quarantined or denied access to sensitive services. For exposure validation, identify devices running legacy iOS versions prior to 12.5.4 and applications using embedded WebKit views. For remediation validation, verify that update installation completed successfully, the device rebooted if required, and compliance state changed from vulnerable to patched.

Typical attack path

1. Identify targets using vulnerable iPhone OS/iOS versions prior to the fixed release.
2. Host or inject maliciously crafted web content that triggers the WebKit use-after-free condition.
3. Deliver the content through phishing links, compromised websites, malicious ads, messages, or in-app web views.
4. Wait for the target to open or preview the content on a vulnerable device.
5. Trigger memory corruption in WebKit and execute attacker-controlled code in the web content process.
6. Optionally chain with a sandbox escape or privilege-escalation exploit to gain broader device control.
7. Deploy surveillance tooling, steal data, access credentials, or maintain covert access.

How to detect it

To assess whether exploitation already occurred, combine mobile device telemetry, MDM records, crash logs, DNS/proxy logs, secure web gateway logs, and mobile threat defense alerts. Look for Safari, WebKit, or embedded web view crashes occurring immediately after visits to unusual domains, shortened links, unsolicited message links, compromised news sites, or ad-delivered content. On iOS devices, collect and review analytics and crash artifacts for repeated EXC_BAD_ACCESS, KERN_INVALID_ADDRESS, or WebKit WebContent crashes, especially around the time of suspicious browsing activity. Examine MDM logs for unexpected configuration profile installation, device enrollment changes, VPN/proxy changes, certificate trust changes, or signs of jailbreak/rootless tampering after suspicious web activity. Review network telemetry for post-exploitation behavior such as unexplained connections to rare domains, newly observed infrastructure, encrypted beaconing, or spyware-like command-and-control patterns. Given public reporting around Candiru/SOURGUM/DevilsTongue, prioritize high-risk users and devices with suspicious link exposure, unexplained crashes, battery/network anomalies, or mobile threat defense detections. Absence of logs does not rule out exploitation, as mobile browser exploits and spyware chains may leave limited artifacts.

• com.apple.WebKit.WebContent
• MobileSafari
• SafariViewService
• WebKit
• JavaScriptCore
• EXC_BAD_ACCESS
• KERN_INVALID_ADDRESS
• Use after free
• JetsamEvent
• /private/var/mobile/Library/Logs/CrashReporter/
• /private/var/mobile/Library/Logs/CrashReporter/JetsamEvent-*.ips
• /private/var/mobile/Library/Logs/CrashReporter/MobileSafari-*.ips
• /private/var/mobile/Library/Logs/CrashReporter/com.apple.WebKit.WebContent-*.ips
• Process: com.apple.WebKit.WebContent
• Process: MobileSafari
• Exception Type: EXC_BAD_ACCESS
• Exception Subtype: KERN_INVALID_ADDRESS

What your security team should do

• Immediately inventory all Apple iPhone OS/iOS devices and identify any running versions earlier than iOS 12.5.4 or otherwise lacking the WebKit fix.
• Prioritize patching or replacement of vulnerable devices because the vulnerability is KEV-listed and was actively exploited in the wild.
• Use MDM compliance rules to block vulnerable or unsupported iOS devices from accessing corporate email, VPN, SSO, and sensitive applications.
• Hunt for signs of prior exploitation on high-risk devices, especially those used by executives, administrators, journalists, legal staff, or other likely spyware targets.
• Review web proxy, DNS, secure web gateway, and mobile threat defense logs for suspicious links opened shortly before Safari/WebKit crashes or device anomalies.
• Escalate forensic review for devices showing repeated WebKit crashes, unexplained profile changes, suspicious network beacons, or evidence of spyware-like behavior.
• Educate users not to open unexpected links, especially from SMS, messaging apps, email, or social media, while recognizing that patching is the primary control.
• Retire devices that cannot receive the fixed iOS release or current security updates.