CVE-2023-23529

What it actually does

CVE-2023-23529 is a WebKit type confusion vulnerability affecting Safari and Apple platforms that use WebKit to render web content. When a vulnerable device processes specially crafted HTML, JavaScript, or other web content, WebKit can mis-handle an object’s type in memory, allowing an attacker to corrupt memory and execute arbitrary code in the context of the browser or web content process. Because exploitation requires only that a user open or preview malicious web content, the flaw is remotely reachable with no authentication, though user interaction is required. Successful exploitation can enable code execution, data access within the browser context, and, when chained with sandbox escape or privilege escalation vulnerabilities, broader device compromise.

Why it matters to the business

This vulnerability can allow a malicious website, advertisement, link, message, or embedded web view to compromise Apple devices used for business. Consequences may include theft of browser-accessible data, session tokens, credentials, email or messaging content exposed through web sessions, surveillance tooling deployment, and disruption of user devices. The issue is listed in CISA KEV and was reported as actively exploited in the wild, with a remediation due date of 2023-03-07, so unpatched systems represent a long-standing and high-priority exposure. Because WebKit is used broadly across Safari, iOS, iPadOS, macOS, and many embedded web views, risk is not limited to users who intentionally browse with Safari.

How an attack unfolds

An attacker prepares malicious web content that triggers the WebKit type confusion condition. The content may be hosted on an attacker-controlled site, inserted into a compromised legitimate site, delivered through a malicious advertisement, or sent as a link through email, SMS, chat, or social media. When a vulnerable iPhone, iPad, or Mac renders the content using Safari or another WebKit-backed application, the malformed script or page causes memory corruption. The attacker’s exploit code then gains arbitrary code execution inside the WebKit content process. In many real-world operations, this browser-level code execution is paired with additional vulnerabilities to escape the browser sandbox, persist, collect sensitive data, or install spyware. Apple reported awareness of active exploitation, and the vulnerability is in the CISA Known Exploited Vulnerabilities catalog, indicating real-world adversary use rather than purely theoretical risk.

How to fix it

Upgrade affected Apple software to versions that include Apple’s fix. The issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, and Safari 16.3. Organizations should deploy the latest available Apple security updates rather than only the minimum fixed versions, because newer releases include additional WebKit and platform hardening. Where immediate patching is not possible, reduce exposure by limiting access to untrusted websites, blocking known malicious domains, disabling or restricting risky browser plugins or extensions where applicable, using DNS/web filtering, and prioritizing patching for users at higher risk of targeted web or messaging attacks. Mitigations should be considered temporary; patching is the only reliable remediation.

How to confirm the fix worked

Confirm that all in-scope Apple devices report fixed or later versions: iOS/iPadOS 15.7.4 or later on the 15.x branch, iOS/iPadOS 16.3.1 or later on the 16.x branch, macOS Ventura 13.2.1 or later, and Safari 16.3 or later where Safari is updated independently. Use MDM, endpoint inventory, or Apple system reporting to verify OS and Safari versions at scale. On macOS, validate with system software inventory and Safari application version checks. On iOS and iPadOS, validate through MDM-reported OS version and security update status. Confirm that no devices remain on vulnerable versions and that update deferrals, unsupported hardware, or failed update states are remediated. Exposure can also be reduced by confirming that web filtering and endpoint telemetry are active on devices that cannot be updated immediately.

Typical attack path

1. Identify users running vulnerable versions of iOS, iPadOS, macOS, or Safari.
2. Deliver a link, malicious webpage, compromised webpage, advertisement, or other WebKit-rendered content to the target.
3. Induce the user or application to render the malicious web content.
4. Trigger the WebKit type confusion bug during page processing.
5. Execute attacker-controlled code in the browser or WebKit content process.
6. Optionally chain with a sandbox escape, kernel, or privilege escalation exploit to gain broader device control.
7. Collect browser data, session material, files accessible to the compromised process, or deploy follow-on tooling.

How to detect it

Detection is difficult because successful WebKit exploitation may leave minimal application-level evidence, and browser memory corruption does not always produce clear indicators. Review endpoint, MDM, EDR, mobile threat defense, DNS, proxy, and secure web gateway telemetry for evidence that vulnerable devices visited suspicious or newly registered domains shortly before Safari or WebKit crashes. On macOS, examine Unified Logs, crash reports, Safari history, browser extension changes, launch agents, launch daemons, login items, configuration profiles, quarantine events, and unusual child processes or network connections associated with Safari or WebKit processes. On iOS/iPadOS, use MDM and mobile threat defense telemetry where available, and look for abnormal device reboots, Safari crashes, unknown profiles, unexpected VPN or proxy settings, and suspicious app or profile installation events. Search for repeated crashes involving WebKit content processes such as com.apple.WebKit.WebContent, MobileSafari, Safari, or WebKit with memory access exceptions around the time of suspicious web access. Because real-world exploitation may be chained with other vulnerabilities, also hunt for post-exploitation indicators such as unknown persistence items, unexpected outbound connections, credential/session theft alerts, suspicious configuration profiles, or anomalous device management changes. Absence of these artifacts does not rule out compromise.

• com.apple.WebKit.WebContent
• com.apple.WebKit.Networking
• com.apple.WebKit.GPU
• MobileSafari
• Safari Web Content
• EXC_BAD_ACCESS
• KERN_INVALID_ADDRESS
• SIGSEGV
• WebKit
• Type confusion
• /Library/Logs/DiagnosticReports/Safari_
• /Library/Logs/DiagnosticReports/com.apple.WebKit.WebContent_
• /Library/Logs/DiagnosticReports/com.apple.WebKit.Networking_
• ~/Library/Logs/DiagnosticReports/Safari_
• ~/Library/Logs/DiagnosticReports/com.apple.WebKit.WebContent_
• ~/Library/Safari/History.db
• /Library/LaunchAgents/
• ~/Library/LaunchAgents/
• /Library/LaunchDaemons/
• /Library/Managed Preferences/
• /var/db/ConfigurationProfiles/
• Profiles installed
• Unknown configuration profile

What your security team should do

• Treat this as a high-priority patching issue because it is in CISA KEV and was reported as actively exploited in the wild.
• Immediately inventory Safari, iOS, iPadOS, and macOS versions and identify systems below iOS/iPadOS 15.7.4, iOS/iPadOS 16.3.1, macOS Ventura 13.2.1, or Safari 16.3.
• Deploy the latest available Apple updates across affected device fleets, prioritizing executives, administrators, developers, security staff, and users exposed to unsolicited links or sensitive data.
• Investigate vulnerable devices that showed Safari/WebKit crashes, suspicious redirects, unknown configuration profiles, unusual persistence, or unexpected network traffic before patching.
• Use MDM controls to reduce update deferrals and require supported OS versions on managed Apple devices.
• Apply DNS, secure web gateway, and email security controls to reduce access to newly registered, suspicious, or known malicious web infrastructure.
• For high-risk users, consider enhanced mobile threat defense, forensic triage, and review of messaging/email links received around suspicious activity windows.
• Retire or isolate Apple devices that cannot receive fixed or later versions.