Introduction
Remote code execution through a single malicious website is a risk for any unpatched Apple device running outdated versions of macOS Ventura, iOS, iPadOS, or Safari. In July 2023, Apple fixed a critical use-after-free vulnerability in WebKit (CVE-2023-43000). An attacker could use it to corrupt memory, and potentially execute arbitrary code, with nothing more than crafted web content for the device to process.
Apple is among the most widely recognized technology companies in the world, and hundreds of millions of active devices run its operating systems. WebKit is the browser engine behind Safari and many Apple apps, and it is a core component for rendering web content on every Apple platform. Because WebKit is built into macOS, iOS, and iPadOS, a vulnerability in it has broad implications across all three.
Technical Information
CVE-2023-43000 is a use-after-free vulnerability (CWE-416) in the WebKit rendering engine. The flaw occurs when the application frees memory but still holds a reference to it, which can lead to memory corruption. In this case, processing specially crafted web content could trigger the vulnerability. Attackers could exploit it by luring users to a malicious website or by injecting malicious content into a trusted site. Successful exploitation could result in arbitrary code execution in the context of the affected application, such as Safari or any other app that uses WebKit for rendering.
Apple's advisory notes that the issue was addressed with improved memory management. No public code snippets or detailed code-level disclosures are available for this vulnerability. The root cause is improper handling of object lifecycles in WebKit, which lets freed memory be accessed again and breaks memory safety.
Affected Systems and Versions
- macOS Ventura versions prior to 13.5
- iOS versions prior to 16.6
- iPadOS versions prior to 16.6
- Safari versions prior to 16.6 (on macOS Big Sur and macOS Monterey)
Any configuration using these versions is vulnerable if WebKit processes untrusted web content.
Vendor Security History
Apple has a recurring history of memory safety issues in WebKit. It has patched multiple use-after-free and memory corruption vulnerabilities in recent years, and it typically responds with coordinated security updates across all supported platforms. Apple publishes advisories and releases patches promptly, but WebKit's complexity keeps making it a frequent target for security research and exploitation.
