CVE-2023-28204: Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability

CVE-2023-28204 is an out-of-bounds read vulnerability in WebKit that affects multiple Apple products, including iOS, iPadOS, macOS, tvOS, watchOS, and Safari. When processing maliciously crafted web content, the flaw may disclose sensitive information. It can also impact other HTML parsers that rely on WebKit, not only Apple Safari. For IT and security teams this matters because WebKit underpins browsing and content rendering on a wide range of devices and applications; successful abuse can leak data without requiring further user interaction beyond visiting or loading the content.

Public detail is limited to the CISA summary and the CWE classification. Confirm exact product versions, patch identifiers, and any additional impact statements against the vendor advisory before acting.

How it works

The weakness is classified as CWE-125 (Out-of-bounds Read). In this class of flaw, code that processes input fails to enforce proper bounds on a memory buffer. When WebKit encounters specially crafted web content, it may read memory outside the intended buffer. The result can be disclosure of whatever data happens to reside in the adjacent memory region at the time of the read.

An attacker would typically deliver the malicious content through a web page, email, or any other channel that causes the vulnerable WebKit component to parse HTML or related web content. No further exploit mechanics are provided in the available facts; teams should treat any untrusted web content as a potential vector and verify behavior against the vendor advisory rather than assuming specific attack sequences.

Am I affected? How to find it in your systems

The vulnerability affects Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit. It may also affect non-Apple products that embed or rely on WebKit for HTML processing. These components commonly appear on endpoint devices, mobile fleets, media devices, and any third-party applications that use WebKit-based rendering engines.

• Inventory all Apple devices and Safari installations in your environment; record OS and browser build numbers.
• Identify non-Apple applications or appliances that declare WebKit or WebKitGTK as a dependency for HTML parsing.
• Compare installed versions against the fixed versions listed in the current Apple security advisory for CVE-2023-28204; do not rely on version numbers from secondary sources.
• Review web-proxy, endpoint-detection, and browser telemetry for anomalous content-processing events or unexpected information-disclosure indicators, though specific log signatures for this CVE are not detailed in the public summary.

If inventory tooling cannot query WebKit versions directly, treat any unpatched Apple OS or Safari instance as potentially affected until confirmed otherwise.

How to remediate

The primary remediation is to apply the updates released by Apple according to the vendor instructions. CISA’s required action is simply to apply those updates. After patching, verify that the installed build numbers match the fixed releases published in the advisory.

• Deploy the vendor updates through your existing mobile-device management, software-update, or configuration-management channels.
• For non-Apple products that embed WebKit, obtain and apply the corresponding updates from those vendors once they have incorporated the fixed WebKit code.
• After remediation, re-inventory to confirm no residual vulnerable instances remain.

Hardening measures that reduce exposure for this class of flaw include restricting untrusted web content, enabling any available content-security or sandboxing features in Safari and other WebKit consumers, and ensuring least-privilege execution for browser processes. These steps complement, but do not replace, the vendor patch.

If you can't patch immediately

When immediate patching is not feasible, apply compensating controls that limit the attack surface and improve detection until the update can be installed.

• Segment devices that must remain on vulnerable builds; isolate them from high-value networks and sensitive data stores.
• Use web application firewalls or secure web gateways to inspect and block known malicious content patterns, understanding that signature coverage for this specific out-of-bounds read may be incomplete.
• Disable or restrict non-essential web-content rendering features where the product allows it; for core Safari or system WebKit this may not be practical.
• Increase monitoring of browser and WebKit process activity, looking for unexpected memory-access anomalies or data-exfiltration attempts.
• Enforce strict network egress controls so that any disclosed information cannot easily leave the environment.

Reassess the temporary controls regularly and prioritize the vendor update as soon as operational constraints allow.

If your data may have been exposed

Out-of-bounds read vulnerabilities can lead to disclosure of sensitive information. While known ransomware use is not documented for this CVE, any successful exploitation of a vulnerability that discloses data can contribute to broader compromise. If you suspect exposure, review access logs, rotate credentials that may have been present in memory, and examine systems for secondary indicators of compromise. Readers can also run a free exposure scan of their email addresses against known breach data sets to determine whether those addresses appear in publicly reported incidents.