CVE-2022-42856

What it actually does

This is a memory-corruption vulnerability caused by type confusion during processing of maliciously crafted web content in Apple WebKit/Safari-related components. A remote attacker can trigger unsafe object state handling through a crafted webpage, leading to arbitrary code execution in the context of the browser or WebKit content process. Because browsers on iOS and iPadOS are required to use WebKit, exposure can extend beyond Safari to other apps that render web content. The flaw requires user interaction, such as opening a malicious link or visiting a compromised site, but no authentication is required. Apple reported active exploitation against iOS versions released before iOS 15.1. The supplied package metadata also lists nodejs/node source as fixed at commit 6e69f8452efa0631bfbefd8ddbd41a813a864645, but the vulnerability description and vendor fixes are Apple platform-focused.

Why it matters to the business

Successful exploitation can allow an attacker to compromise user devices through web browsing, potentially enabling theft of sensitive data, surveillance, session hijacking, installation of additional payloads, or disruption of device availability. Because the vulnerability is in commonly used web-rendering components and is listed in CISA KEV with a remediation due date of 2023-01-04, it should be treated as historically exploited and high priority wherever legacy Apple devices remain in use. Risk is highest for unpatched iPhones, iPads, Macs, Apple TVs, and managed devices that access email, messaging, web links, or third-party apps with embedded browsers.

How an attack unfolds

An attacker prepares a webpage or web-delivered payload that exercises the vulnerable type-confusion condition in WebKit. The attacker then delivers the link through phishing, messaging, malvertising, a compromised legitimate website, or another app that opens embedded web content. When a vulnerable device processes the crafted content, memory corruption can occur and attacker-controlled code may execute within the WebKit/Safari process context. In a targeted campaign, that initial code execution may be chained with a sandbox escape, privilege escalation, persistence mechanism, or spyware implant. Apple confirmed reports of active exploitation against iOS versions before iOS 15.1, so organizations should assume that exposed legacy devices were viable targets before patching.

How to fix it

Upgrade affected Apple software to versions that include the fix: Safari 16.2 or later, tvOS 16.2 or later, macOS Ventura 13.1 or later, iOS 15.7.2 or later, iPadOS 15.7.2 or later, and iOS 16.1.2 or later. Prefer upgrading to the latest supported OS release rather than only the minimum fixed version. Remove or isolate devices that cannot receive these updates, especially those running iOS versions before 15.1. Enforce mobile device management compliance rules for minimum OS versions, block unmanaged or noncompliant devices from sensitive services, and restrict risky link handling where possible. If the supplied nodejs/node source metadata applies to an internal build context, ensure the source includes commit 6e69f8452efa0631bfbefd8ddbd41a813a864645 or a later fixed revision, but prioritize Apple platform remediation for this CVE based on the vulnerability description.

How to confirm the fix worked

Confirm that Apple endpoints report fixed or later versions: Safari 16.2+, tvOS 16.2+, macOS Ventura 13.1+, iOS/iPadOS 15.7.2+, or iOS 16.1.2+. Use MDM inventory, endpoint management tooling, software update status, and configuration compliance reports to identify devices below those versions. Validate that no unsupported legacy Apple devices continue to access sensitive applications. For Safari on macOS, verify the installed Safari build and WebKit framework version after patching. For source-based environments using the listed nodejs/node metadata, verify that commit 6e69f8452efa0631bfbefd8ddbd41a813a864645 or a later fixed revision is present in the build provenance. Re-run vulnerability scanners and asset inventory queries after updates to confirm exposure has been cleared.

Typical attack path

1. Identify users or devices likely to run vulnerable Apple OS or Safari/WebKit versions.
2. Host or inject maliciously crafted web content designed to trigger the type-confusion bug.
3. Deliver the content through phishing links, SMS or messaging apps, malvertising, compromised websites, or embedded in-app browsers.
4. Wait for the user or application to render the malicious content.
5. Exploit WebKit memory corruption to obtain code execution in the browser or web content process.
6. Optionally chain additional vulnerabilities to escape sandbox restrictions or elevate privileges.
7. Deploy follow-on payloads, collect browser/session data, access device information, or establish surveillance capability.
8. Delete or minimize obvious artifacts, leaving mainly browser history, network traces, crash logs, and post-exploitation indicators.

How to detect it

To determine whether exploitation may already have occurred, correlate endpoint, mobile device management, network, and identity telemetry around the period when vulnerable devices were in use. Review iOS/iPadOS/macOS crash logs for repeated or unusual crashes in Safari, WebKit, WebContent, or apps with embedded browsers, especially crashes occurring immediately after visiting unfamiliar URLs. Examine browser history, proxy logs, DNS logs, secure web gateway logs, and email/message security telemetry for suspicious links, redirect chains, newly registered domains, malvertising patterns, or visits shortly before WebKit crashes. On macOS, inspect unified logs, EDR telemetry, LaunchAgents/LaunchDaemons, persistence locations, browser extensions, downloaded files, and child processes spawned around Safari/WebKit activity. On mobile devices, use MDM and mobile threat defense telemetry to look for abnormal profiles, unexpected VPN/proxy settings, jailbreak indicators, suspicious certificates, anomalous battery/network usage, or unknown apps installed after suspicious browsing events. Because public exploit artifacts for this issue are not reliably unique, detection should focus on behavioral chains: vulnerable version present, malicious or unusual web content rendered, WebKit/Safari crash or instability, followed by unusual outbound connections, persistence attempts, profile changes, or data access anomalies. Threat context should include Apple-reported in-the-wild exploitation against iOS versions before 15.1; absence of known indicators does not rule out compromise.

• com.apple.WebKit.WebContent
• WebKit.WebContent
• MobileSafari
• Safari
• JetsamEvent
• EXC_BAD_ACCESS
• KERN_INVALID_ADDRESS
• Type confusion
• WKWebView
• SFSafariViewController
• /Library/Logs/DiagnosticReports/Safari_
• /Library/Logs/DiagnosticReports/com.apple.WebKit.WebContent_
• /Library/Logs/DiagnosticReports/WebKit.WebContent_
• ~/Library/Logs/DiagnosticReports/Safari_
• ~/Library/Logs/DiagnosticReports/com.apple.WebKit.WebContent_
• /Library/LaunchAgents/
• /Library/LaunchDaemons/
• ~/Library/LaunchAgents/
• ConfigurationProfiles

What your security team should do

• Prioritize remediation for all Apple devices below the fixed versions, especially iOS devices before 15.1 because Apple reported active exploitation in the wild.
• Use MDM or endpoint inventory to find noncompliant iOS, iPadOS, macOS, tvOS, and Safari installations and enforce minimum supported versions.
• Treat this as a KEV-listed exploited vulnerability; investigate any high-risk users or devices that remained unpatched after the 2023-01-04 CISA deadline.
• Review crash logs, browser history, proxy/DNS telemetry, EDR events, and mobile threat defense alerts for signs of WebKit crashes followed by suspicious network activity or process behavior.
• For high-risk or potentially targeted devices, perform mobile forensic triage rather than relying only on user-visible symptoms.
• Block or quarantine unsupported Apple devices from accessing sensitive enterprise resources until updated or replaced.
• Increase monitoring for phishing, suspicious shortened links, malvertising redirects, and unexpected web traffic from legacy Apple devices.
• If internal builds are affected by the supplied nodejs/node metadata, update to a revision containing commit 6e69f8452efa0631bfbefd8ddbd41a813a864645 or later and rebuild dependent artifacts.