CVE-2021-30887

What it actually does

Logic flaw in WebKit allows maliciously crafted web content to bypass Content Security Policy enforcement, resulting in unauthorized script execution or resource loading that should have been blocked.

Why it matters to the business

Organizations face elevated risk of web-based attacks on employee and customer devices running affected Apple platforms, potentially enabling data theft or unauthorized actions without user awareness; widespread use of these platforms increases exposure across enterprises and consumer ecosystems.

How an attack unfolds

An attacker crafts a malicious webpage containing content that violates the declared Content Security Policy; when a victim using a vulnerable WebKit-based browser visits the page, the policy restrictions are unexpectedly unenforced, allowing the attacker's scripts or resources to execute. Groups such as Candiru have been associated with similar Apple WebKit targeting campaigns.

How to fix it

Upgrade affected devices to the fixed releases: macOS Monterey 12.0.1 or later, iOS 15.1 / iPadOS 15.1 or later, watchOS 8.1 or later, tvOS 15.1 or later. Apply vendor updates promptly for all Apple platforms and review any downstream Linux packages that incorporate the vulnerable WebKit components.

How to confirm the fix worked

Verify device and application versions against the fixed releases listed by Apple; inspect web content rendering behavior in updated browsers to confirm CSP enforcement; use automated vulnerability scanners or MDM tools to audit fleet compliance.

Typical attack path

1. Attacker prepares and hosts a webpage embedding CSP-violating content.
2. Victim is lured to the malicious page via phishing, compromised site, or drive-by download.
3. Vulnerable WebKit processes the page and fails to enforce the CSP.
4. Attacker's code executes with elevated privileges or access, achieving integrity impact such as unauthorized actions.

How to detect it

Review web proxy, browser, and endpoint logs for unexpected script execution or resource loads that violate declared CSP headers; correlate with visits to untrusted domains around the time of suspected exposure; examine crash reports or WebKit process anomalies on affected devices for signs of policy bypass attempts.

What your security team should do

• Prioritize patching all managed Apple devices to the specified fixed versions within the next maintenance window.
• Enable strict CSP headers on internal and external web applications as a defense-in-depth measure.
• Monitor threat intelligence feeds for continued activity by groups such as Candiru targeting similar WebKit issues.
• Educate users on avoiding suspicious links and maintain endpoint detection on mobile and desktop fleets.