CVE-2023-43000

What it actually does

CVE-2023-43000 is a use-after-free memory corruption vulnerability in Apple’s web content processing stack affecting Safari, iOS, iPadOS, and macOS. When a vulnerable device processes specially crafted web content, memory that has already been freed can be referenced again, potentially allowing an attacker to corrupt process memory. With successful exploitation, this can lead to arbitrary code execution in the context of the browser or WebKit web content process, with possible compromise of confidentiality, integrity, and availability. The CVSS vector indicates network-based exploitation, low attack complexity, no required privileges, and user interaction required, typically by causing a user to open a malicious page or embedded web content.

Why it matters to the business

Successful exploitation can allow an attacker to compromise Apple endpoints through web browsing or web-rendered content, potentially leading to data theft, account compromise, malware installation, device instability, or follow-on access into business applications used from affected devices. Because this vulnerability is listed in CISA KEV and marked as actively exploited in the wild, organizations should treat it as a priority patching item even though exploitation requires user interaction. The CISA remediation due date is 2026-03-26. The affected product set is broad across Safari, iOS, iPadOS, and macOS, so exposure may include managed workstations, mobile devices, BYOD devices, kiosks, and any systems relying on Apple’s WebKit-based content rendering.

How an attack unfolds

An attacker prepares malicious web content designed to trigger the use-after-free condition during parsing or rendering. The attacker then delivers that content through a malicious website, compromised legitimate website, link in email or messaging, malvertising, or another application that displays web content using Apple’s web rendering components. When a user on a vulnerable Apple device opens the content, the browser or WebKit web content process mishandles memory and references freed memory. A reliable exploit can use this memory corruption to gain control over execution flow, execute attacker-controlled code in the affected process, and potentially chain with a sandbox escape or privilege escalation vulnerability for broader device compromise. Because the vulnerability is known to be actively exploited, defenders should assume real-world attacks may be targeted, may use short-lived infrastructure, and may leave limited artifacts beyond browser crashes, suspicious web history, unusual WebKit process behavior, and post-exploitation activity.

How to fix it

Upgrade affected Apple products to fixed versions or later. Apple states the issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, and iOS 15.8.7 and iPadOS 15.8.7. Where supported, upgrade to the latest available Apple security release rather than only the minimum fixed version, as current releases may include additional fixes and hardening. Prioritize internet-facing and high-risk user populations, including executives, administrators, developers, security staff, and users likely to receive targeted links or attachments. If immediate patching is not possible, reduce exposure by restricting access to untrusted websites, disabling or limiting risky browser extensions, using web filtering and DNS filtering, isolating browsing activity, enforcing mobile device management compliance policies, and preventing use of unsupported Apple operating system versions.

How to confirm the fix worked

Confirm affected assets report fixed or later versions: Safari 16.6 or later, macOS Ventura 13.5 or later, iOS/iPadOS 16.6 or later, or iOS/iPadOS 15.8.7 or later for devices remaining on the iOS/iPadOS 15 branch. Validate through MDM inventory, endpoint management, software update reporting, vulnerability scanning where supported, and direct device checks of OS and Safari versions. Confirm that managed devices are not deferring Apple security updates beyond policy limits. Test representative macOS, iOS, and iPadOS devices by verifying the reported build and Safari version after patch deployment. For risk acceptance cases, document compensating controls such as web isolation, content filtering, and removal from high-risk access groups.

Typical attack path

1. Identify users or devices running vulnerable versions of Safari, iOS, iPadOS, or macOS.
2. Host or inject maliciously crafted web content that triggers the use-after-free flaw.
3. Lure the user to open the content through phishing, messaging, malvertising, watering-hole compromise, or embedded web views.
4. Trigger memory corruption in Safari or the WebKit web content process when the page is processed.
5. Execute attacker-controlled code within the browser or web content process if exploitation succeeds.
6. Optionally chain with another vulnerability to escape sandbox restrictions or gain higher privileges.
7. Deploy payloads, steal browser/session data, access sensitive applications, or establish persistence depending on the attacker’s objectives.

How to detect it

Detection should focus on suspicious web activity, WebKit/Safari crash artifacts, and post-exploitation behavior. Review macOS crash reports, unified logs, EDR telemetry, browser history, DNS logs, proxy logs, secure web gateway logs, and MDM security events for activity where access to unknown or suspicious web content is closely followed by Safari or WebKit crashes, memory access violations, unexpected payload downloads, or unusual process execution. On macOS, inspect crash reports for Safari and WebKit web content processes showing memory corruption symptoms such as EXC_BAD_ACCESS or KERN_INVALID_ADDRESS around the time of suspicious browsing. On iOS and iPadOS, collect and review available analytics, crash, MDM, and security telemetry for WebKit or Safari crashes correlated with suspicious URLs. Because this vulnerability may be used as part of exploit chains and public reporting does not identify a universal network signature, defenders should also hunt for downstream signs: new persistence mechanisms, suspicious configuration profiles, unexpected VPN/proxy changes, abnormal authentication from Apple devices, credential theft indicators, unusual outbound connections after browsing events, and execution of unfamiliar binaries or scripts on macOS. If threat intelligence identifies campaign-specific domains, URLs, or payload hashes, add them to DNS, proxy, EDR, and SIEM hunts, but absence of those indicators does not rule out exploitation.

• com.apple.WebKit.WebContent
• Safari
• EXC_BAD_ACCESS
• KERN_INVALID_ADDRESS
• Use-After-Free
• ~/Library/Logs/DiagnosticReports/Safari_
• ~/Library/Logs/DiagnosticReports/com.apple.WebKit.WebContent_
• /Library/Logs/DiagnosticReports/Safari_
• /Library/Logs/DiagnosticReports/com.apple.WebKit.WebContent_

What your security team should do

• Treat this as urgent because it is in the CISA Known Exploited Vulnerabilities catalog and has active exploitation reported in the wild.
• Inventory all Apple endpoints and browsers, including managed mobile devices, macOS workstations, shared devices, and BYOD devices that access business resources.
• Patch to the latest supported Apple release, ensuring at minimum macOS Ventura 13.5, Safari 16.6, iOS/iPadOS 16.6, or iOS/iPadOS 15.8.7 where applicable.
• Prioritize users with privileged access, sensitive data access, externally exposed roles, or high likelihood of targeted phishing.
• Use MDM or endpoint compliance controls to block access to sensitive business applications from devices below fixed versions.
• Review web proxy, DNS, EDR, and Apple device logs for suspicious web access followed by Safari/WebKit crashes, unusual child processes, payload downloads, or credential access behavior.
• Hunt for post-exploitation activity rather than relying only on vulnerability-specific indicators, because public reporting does not provide a stable exploit signature.
• Educate users to avoid unexpected links and attachments while patch deployment is underway, especially on mobile devices where browser exploitation may be less visible.
• Track the CISA KEV due date of 2026-03-26 as a latest acceptable remediation deadline, not as a reason to delay patching.