CVE-2021-30858: Apple iOS, iPadOS, macOS Use-After-Free Vulnerability

CVE-2021-30858 is a use-after-free vulnerability in WebKit on Apple iOS, iPadOS, and macOS. Processing maliciously crafted web content can lead to code execution. It matters because WebKit underpins Safari and other HTML parsers, so a successful exploit can compromise devices that render untrusted web content. Confirm exact scope and fixed builds against the vendor advisory.

CISA notes that the issue can affect HTML parsers that use WebKit, including Apple Safari and non-Apple products that rely on WebKit for HTML processing. Known ransomware use is not documented. The required action is to apply updates per vendor instructions.

How it works

The weakness is CWE-416 (use-after-free). In this class of flaw, memory is freed while a pointer to it remains in use. If an attacker can influence what is written into that freed region and then trigger a later use of the stale pointer, the program may execute attacker-controlled data.

For this CVE, the CISA summary states that Apple iOS, iPadOS, and macOS WebKit contain a use-after-free that leads to code execution when processing maliciously crafted web content. An attacker would typically deliver that content through a web page or other HTML that is parsed by a WebKit-based engine. Specific exploit mechanics, version ranges, and any privilege or sandbox details must be confirmed against the vendor advisory; do not assume unstated behavior.

Am I affected? How to find it in your systems

This software runs on Apple mobile and desktop platforms: iOS and iPadOS devices, and macOS systems. WebKit is used by Safari and can appear in other applications or embedded HTML parsers that depend on WebKit, including some non-Apple products.

• Inventory Apple endpoints via MDM, Apple Business Manager, Jamf, or similar asset tools; record OS build and Safari/WebKit-related app versions.
• Identify non-Apple applications that embed or link WebKit for HTML processing; treat those as potentially in scope until the vendor advisory clarifies.
• Compare installed versions to the fixed releases named in Apple’s advisory; do not rely on guessed version numbers.
• For exploitation signs, review device and proxy logs for unexpected crashes in Safari or WebKit processes, sudden process launches after web browsing, or anomalous outbound connections following visits to untrusted sites. Telemetry will vary by environment; correlate with EDR and web gateway logs rather than assuming a single signature.

How to remediate

Patch first. Apply the updates Apple provides for iOS, iPadOS, and macOS per the vendor advisory and CISA’s direction to apply updates per vendor instructions. Prioritize internet-facing and user-browsing devices.

• Deploy OS updates through MDM or controlled update channels; verify installation with inventory reports.
• Update any third-party products that ship or embed WebKit once their vendors release corresponding fixes; confirm against each vendor’s advisory.
• After patching, harden browsing posture: restrict untrusted web content where policy allows, keep browser and OS auto-update enabled where operationally acceptable, and ensure EDR or endpoint protection remains active on macOS and supervised mobile devices.
• Re-scan or re-inventory to confirm residual vulnerable builds are gone.

If you can't patch immediately

Reduce exposure until updates can be applied.

• Segment high-risk or unpatched devices from sensitive networks; limit their ability to reach critical internal resources.
• Use web filtering, secure web gateways, or virtual patching/WAF rules that block or sandbox known malicious or uncategorized web content that could deliver crafted HTML.
• Where feasible, disable or restrict nonessential WebKit-dependent features or alternate browsers that embed WebKit until patched.
• Increase monitoring: alert on WebKit/Safari crashes, unusual child processes, and post-browse network anomalies; retain logs for incident review.
• Prefer supervised device configurations and least-privilege accounts so a single content-driven compromise has less room to move.

If your data may have been exposed

Actively exploited vulnerabilities can lead to device compromise and data theft even when ransomware use is not documented for this CVE. If you suspect exposure, isolate affected devices, preserve logs, rotate credentials accessible from those devices, and follow your incident response process. You can run a free exposure scan of your email to check known breach data and determine whether addresses tied to your environment appear in prior breaches.