Actively exploited in the wild

Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability

Apple - iOS, iPadOS, and watchOS · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2021-1879

MediumCVSS 6.1KEV

Published: 02/04/2021(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

This issue was addressed by improved management of object lifetimes. The issue is fixed in iOS 12.5.2, iOS 14.4.2, iPadOS 14.4.2, and watchOS 7.3.3, and processing maliciously crafted web content may lead to universal cross-site scripting. Apple is aware of a report that this issue may have been actively exploited.

Risk Assessment

Universal cross-site scripting may allow data theft or actions in the user's context; there are reports of active exploitation.

Recommendation

Immediately update Apple devices to iOS 12.5.2, iOS 14.4.2, iPadOS 14.4.2, or watchOS 7.3.3 (or later) to fix the vulnerability.

Other vulnerabilities in Apple iOS, iPadOS, watchOS

CVE-2026-86886Medium
A path traversal issue was found in Apple systems and fixed with improved input validation. An app may be able to modify protected system files.

Original NVD description (English source)

This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited..