CVE-2021-30858

What it actually does

This is a WebKit use-after-free vulnerability that can be triggered when Apple platforms process maliciously crafted web content. A remote attacker can cause memory that has already been freed to be reused in a controlled way, leading to arbitrary code execution in the context of the browser or WebKit-based application. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and user interaction required, with high confidentiality, integrity, and availability impact. In practical attacks, this class of bug is often chained with sandbox escape or privilege-escalation vulnerabilities to gain broader device control.

Why it matters to the business

Successful exploitation can allow attackers to compromise iPhones, iPads, or Macs simply by getting a user to open or render malicious web content, potentially leading to spyware deployment, theft of sensitive communications, credential compromise, surveillance, and disruption of endpoint trust. This vulnerability is listed in CISA KEV with known exploitation and had a remediation deadline of 2021-11-17, so any remaining unpatched assets should be treated as high-priority legacy exposure. Reported exploitation associated with commercial spyware activity, including Candiru / SOURGUM / DevilsTongue, increases the risk for organizations with executives, legal teams, journalists, government users, or other high-value targets.

How an attack unfolds

An attacker prepares a malicious webpage or web-delivered payload that triggers the WebKit use-after-free condition. The attacker then delivers the content through a link, redirect, compromised site, malicious advertisement, embedded webview, or other mechanism that causes Safari or another WebKit-based application to process it. When the vulnerable WebKit engine parses the crafted content, memory corruption occurs and attacker-controlled code can execute within the affected process. From there, the attacker may attempt to escape browser or app sandbox restrictions, elevate privileges, install surveillance tooling, access local data available to the compromised process, steal session material, or use the device as a foothold. Because Apple reported active exploitation and the issue is in CISA KEV, defenders should assume exploit chains may have been used selectively against high-value targets rather than broadly visible commodity scanning.

How to fix it

Upgrade affected Apple platforms to fixed or later versions immediately. Apple addressed the issue in iOS 14.8, iPadOS 14.8, and macOS Big Sur 11.6; any later supported Apple release that includes the corresponding WebKit fix should also be considered remediated. Where available, move devices to the latest supported iOS, iPadOS, macOS, and Safari/WebKit updates rather than only the minimum fixed version. For systems that cannot be updated, reduce exposure by restricting untrusted web browsing, limiting use of embedded webviews, disabling automatic link previews where feasible, applying mobile device management controls, isolating high-risk users, and monitoring closely for compromise. If source or package metadata references unrelated affected products or fixed commits, validate the advisory mapping before relying on that metadata; the described vulnerability and fixes are Apple WebKit platform fixes.

How to confirm the fix worked

Confirm installed operating system and browser/WebKit versions are at or above the fixed releases: iOS 14.8 or later, iPadOS 14.8 or later, and macOS Big Sur 11.6 or later, or a newer supported Apple release containing the fix. Validate through MDM inventory, endpoint management telemetry, Apple system profiler output, software update status, or vulnerability scanner checks that correctly identify Apple security updates. On macOS, confirm Safari/WebKit-related updates are installed where they are distributed separately. Review fleet reports for devices running older 14.x iOS/iPadOS builds or macOS Big Sur versions before 11.6 and prioritize them for remediation. After patching, verify devices have rebooted where required and that no vulnerable OS versions remain in active use.

Typical attack path

1. Identify targets using vulnerable iOS, iPadOS, or macOS versions that include the affected WebKit component.
2. Host or inject maliciously crafted web content designed to trigger the use-after-free condition.
3. Deliver the content through phishing, messaging, malicious redirects, compromised websites, advertising infrastructure, or application webviews.
4. Wait for the target device to render the content in Safari or another WebKit-based application.
5. Trigger memory corruption and execute attacker-controlled code in the WebKit process context.
6. Optionally chain a sandbox escape or privilege-escalation exploit to gain broader access to the device.
7. Deploy spyware, persistence mechanisms, credential/session theft, surveillance capabilities, or data exfiltration tooling.
8. Clean up transient artifacts where possible to reduce forensic visibility.

How to detect it

Detection should focus on signs of prior exploitation rather than simple network scanning, because this is a client-side WebKit memory-corruption issue and attacks may be targeted. Collect and review macOS DiagnosticReports, iOS/iPadOS crash logs available through device analytics, MDM telemetry, EDR events, Safari/WebKit logs, DNS/proxy records, and security appliance logs. Look for Safari, MobileSafari, WebKit, WebKit.WebContent, or JavaScriptCore crashes, especially EXC_BAD_ACCESS or KERN_INVALID_ADDRESS events, shortly after visiting suspicious links, redirects, shortened URLs, messaging-app previews, or unfamiliar domains. Correlate browser or WebKit crashes with subsequent suspicious behavior such as new configuration profiles, unexpected persistence items, unusual background processes, abnormal outbound connections, access to sensitive files, or device management changes. For high-risk users, search for references to known reporting labels and actor names such as Candiru, SOURGUM, and DevilsTongue in threat-intelligence-enriched proxy, DNS, mail, and EDR telemetry, but do not rely on actor-name strings alone as evidence. Absence of logs does not rule out exploitation, especially on mobile devices with limited retention; if targeted compromise is suspected, preserve the device state and perform specialized mobile forensic acquisition.

• com.apple.WebKit.WebContent
• MobileSafari
• Safari_*.crash
• WebKit_*.crash
• JavaScriptCore
• EXC_BAD_ACCESS
• KERN_INVALID_ADDRESS
• /Library/Logs/DiagnosticReports/
• ~/Library/Logs/DiagnosticReports/
• /var/mobile/Library/Logs/CrashReporter/
• /private/var/mobile/Library/Logs/CrashReporter/
• Candiru
• SOURGUM
• DevilsTongue

What your security team should do

• Treat unpatched Apple devices as high priority because the vulnerability is in CISA KEV and has documented in-the-wild exploitation.
• Immediately inventory iOS, iPadOS, and macOS versions across managed and unmanaged endpoint populations.
• Patch or replace devices below iOS 14.8, iPadOS 14.8, or macOS Big Sur 11.6, preferring the latest supported Apple release.
• Prioritize high-risk users such as executives, legal, finance, government-facing personnel, journalists, administrators, and users handling sensitive communications.
• Hunt for suspicious Safari, WebKit, MobileSafari, and WebContent crashes around the first known exposure window and around suspicious messages or links.
• Review MDM, EDR, DNS, proxy, and network telemetry for unusual web access followed by process crashes, new profiles, suspicious background processes, or data exfiltration.
• If compromise is suspected, preserve device logs and crash reports before wiping or upgrading, and consider specialist mobile forensics because spyware artifacts may be sparse.
• Restrict automatic link previews and access to untrusted web content where operationally feasible for high-risk users.
• Educate users to report unexpected links, redirects, browser crashes, or device behavior changes, while recognizing that targeted exploit delivery may not be obvious to the user.
• Validate vulnerability-management data quality if any scanner maps this Apple WebKit CVE to unrelated non-Apple packages.