CVE-2021-30846

What it actually does

Memory corruption in WebKit allows processing of maliciously crafted web content to trigger arbitrary code execution with the privileges of the affected process.

Why it matters to the business

Successful exploitation can result in complete device compromise enabling data theft, persistent surveillance, or installation of additional malware across widely deployed consumer and enterprise Apple platforms.

How an attack unfolds

Attackers including Candiru and related groups deliver malicious web content through Safari or embedded WebKit views; when rendered on an unpatched device the memory corruption is triggered to achieve remote code execution without further user interaction beyond visiting the page.

How to fix it

Update affected Apple products to iOS 14.8 / iPadOS 14.8, Safari 15, tvOS 15, iOS 15 / iPadOS 15, or watchOS 8 (or newer releases) as soon as possible; apply the same updates to any downstream distributions such as Debian or Fedora packages that incorporate the vulnerable WebKit components.

How to confirm the fix worked

Confirm that device and application version strings match or exceed the fixed releases listed in the Apple security updates; re-scan systems after patching to ensure no vulnerable versions remain.

Typical attack path

1. Craft malicious web content that targets the WebKit memory handling flaw
2. Host or deliver the content via phishing, watering-hole, or compromised site
3. Victim opens the content in a vulnerable browser or app on iOS, iPadOS, macOS, tvOS or watchOS
4. Memory corruption is triggered leading to arbitrary code execution

How to detect it

Search browser history, proxy logs and WebKit crash reports for visits to suspicious domains linked to Candiru or DevilsTongue campaigns; correlate with device telemetry showing unexpected process launches or memory anomalies shortly after web content rendering.

What your security team should do

• Prioritize patching all affected Apple devices and browsers within the next 48 hours given documented exploitation by advanced threat actors
• Block or monitor access to known malicious domains associated with the listed threat actors
• Enable automatic updates where feasible and audit enterprise-managed devices for compliance
• Review browser and WebKit crash logs for signs of unexpected memory handling failures