CVE-2022-46691

What it actually does

Memory consumption flaw in WebKit allows crafted web content to trigger corruption leading to arbitrary code execution.

Why it matters to the business

Attackers may gain full control of affected Apple devices, enabling data theft or persistence; widespread user base increases exposure though no KEV listing or ransomware use is recorded.

How an attack unfolds

An attacker hosts or delivers malicious web content exploiting the WebKit memory issue; when rendered in a vulnerable Safari or iOS browser, the flaw is triggered resulting in code execution. Named threat actors have referenced variants of this Apple WebKit type confusion class.

How to fix it

Upgrade affected products to fixed versions including Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Apply updates immediately given the high CVSS and positive EPSS trend.

How to confirm the fix worked

Confirm devices report the patched OS/browser versions listed in remediation; retest web content rendering in updated environments and verify no crash or unexpected memory growth on known triggers.

Typical attack path

1. Craft malicious web content targeting WebKit memory handling
2. Host content on attacker-controlled site or deliver via phishing
3. Victim browses to the page using a vulnerable Apple product
4. Memory corruption occurs leading to arbitrary code execution

How to detect it

Review web proxy, browser, and device logs for visits to suspicious domains or repeated crashes in WebKit processes; correlate with threat actor references to Apple WebKit type confusion activity.

What your security team should do

• Prioritize patching all Apple devices to the listed fixed releases within standard change windows
• Monitor EPSS trend and re-evaluate if exploit maturity advances
• Block or filter untrusted web content for high-risk user populations until patches are deployed