CVE-2023-23517

What it actually does

Memory corruption vulnerability in WebKit that allows arbitrary code execution when processing maliciously crafted web content.

Why it matters to the business

Compromised user devices across macOS, iOS, iPadOS, watchOS, tvOS and Safari deployments can result in data theft, unauthorized access, and malware installation; with over 1327 days since publication and stable low exploit probability, immediate widespread impact remains limited but requires prompt patching to protect large installed bases.

How an attack unfolds

An attacker hosts a malicious webpage exploiting a type confusion or memory handling flaw in WebKit; when a victim visits the page, the crafted content triggers memory corruption leading to arbitrary code execution in the browser process. Named threat actors have referenced this class of Apple WebKit issues in campaigns.

How to fix it

Update affected systems to the fixed releases: macOS Monterey 12.6.3, macOS Ventura 13.2, macOS Big Sur 11.7.3, Safari 16.3, iOS 16.3, iPadOS 16.3, watchOS 9.3, and tvOS 16.3. Apply updates enterprise-wide via MDM or manual installation and verify version post-deployment.

How to confirm the fix worked

Confirm device and application versions match or exceed the listed fixed releases; test browsing known trigger pages in isolated environments to verify no crash or unexpected behavior occurs.

Typical attack path

1. Attacker prepares and hosts malicious web content targeting WebKit memory handling
2. Victim is directed to or visits the malicious page via Safari or other affected browsers
3. Web content processing triggers the memory corruption flaw
4. Arbitrary code executes within the browser sandbox or context
5. Attacker achieves persistence, data access, or further lateral movement

How to detect it

Review system and browser process logs for unexpected WebKit crashes or memory errors following web browsing sessions; correlate with threat actor references to Apple WebKit vulnerabilities in incident reports.

What your security team should do

• Prioritize deployment of the listed version updates to all managed Apple devices and browsers
• Monitor EPSS and threat intelligence for any increase in exploit activity
• Enable automatic updates where possible and audit for unpatched endpoints
• Educate users on avoiding suspicious links pending full rollout