CVE-2021-30761: Apple iOS WebKit Memory Corruption Vulnerability

CVE-2021-30761 is a memory corruption vulnerability in Apple iOS WebKit that can lead to code execution when the component processes maliciously crafted web content. It matters because WebKit underpins browsing and HTML parsing on iOS and can also appear in other products that embed WebKit, so a successful exploit may give an attacker a foothold on the device or in any dependent HTML-processing path.

CISA notes that the issue can affect HTML parsers that use WebKit, including Apple Safari and non-Apple products that rely on WebKit. Defenders should treat any unpatched WebKit-based surface as in scope until they confirm status against the vendor advisory.

How it works

The weakness is classified as CWE-787 (out-of-bounds write), a form of memory corruption. In broad terms, the vulnerable code mishandles memory while parsing or rendering web content. An attacker who can present specially crafted web content to the affected WebKit instance may trigger the corruption and achieve code execution in the context of the process that hosts WebKit.

No further exploit mechanics are provided in the available facts. Exact trigger conditions, required user interaction, and any sandbox escape details must be confirmed against the vendor advisory. The practical takeaway for defenders is that the attack surface is content processing: any path that feeds untrusted HTML or web content into WebKit is relevant.

Am I affected? How to find it in your systems

The vulnerability is reported against Apple iOS WebKit. WebKit typically runs inside the Safari browser and other system components that render web content on iOS devices. It can also appear in third-party applications or non-Apple products that embed WebKit for HTML parsing.

• Inventory managed iOS devices (MDM, endpoint management, or asset databases) and record the installed iOS version.
• Identify applications that embed WebKit or perform HTML rendering; treat any such component as potentially in scope until the vendor states otherwise.
• Compare device and application versions to the fixed releases listed in Apple’s security advisory for this CVE; do not rely on version guesses.
• Review web-proxy, DNS, or endpoint logs for unusual browsing destinations or crashes in Safari/WebKit-related processes around the time of suspected exposure; such signals are suggestive only and are not definitive proof of exploitation.

Because public detail on exact affected builds is limited here, confirm every version and configuration against the official vendor advisory before declaring a system clear.

How to remediate

Patch first. Apply the updates Apple released for this issue, following the vendor’s instructions exactly as CISA requires. Use your MDM or standard iOS update process to drive the fixed build to all managed devices, and verify installation afterward.

• Prioritize devices that browse untrusted content or that run apps known to embed WebKit.
• After the OS update, check for any separate application updates from vendors that ship their own WebKit-based HTML engines.
• Re-inventory to confirm no residual unpatched builds remain.
• As general hardening for this class of flaw, keep automatic updates enabled where policy allows, restrict sideloading or unapproved web engines, and limit the set of apps permitted to process arbitrary web content.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment high-risk or internet-facing devices and limit their ability to reach untrusted web content.
• Use secure web gateways, content filters, or DNS controls to block known-malicious or uncategorized sites that could deliver crafted content.
• Where feasible, disable or restrict non-essential browsers and WebKit-embedding apps, or force browsing through a hardened, isolated enterprise browser.
• Increase monitoring for WebKit/Safari crashes, unexpected process launches, or anomalous network connections from iOS fleets; alert on deviations from baseline.
• Virtual patching via network or endpoint controls is limited for client-side WebKit flaws, so treat filtering and isolation as temporary risk reduction only.

These steps do not eliminate the vulnerability; they only buy time until the official update is installed.

If your data may have been exposed

Actively exploited memory-corruption bugs in content parsers can lead to device compromise and subsequent data exposure. Known ransomware use of this specific CVE is not documented in the provided facts, but any confirmed compromise should still trigger standard incident response: isolate the device, preserve logs, rotate credentials accessible from it, and assess what data the device could reach. You can run a free exposure scan of your email addresses against known breach data sets to check whether associated accounts already appear in public breach corpora, then proceed with password resets and monitoring as needed.