Actively exploited in the wild
Apple Multiple Products WebKit Sandbox Escape Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2023-05-22. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2023-32409
HighCVSS 8.6KEVSummary
The issue was addressed with improved bounds checks. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
Risk Assessment
An attacker could bypass browser sandbox protections, potentially leading to arbitrary code execution on the device.
Recommendation
Update systems to the latest versions: watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5.
Other vulnerabilities in Apple WebKit
See all- CVE-2023-32435HighActively exploited
A memory corruption issue was addressed with improved state management. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
- CVE-2023-32373HighActively exploited
A use-after-free issue was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- CVE-2021-1789HighActively exploited
A type confusion issue exists in Apple products (macOS, iOS, iPadOS, watchOS, tvOS, Safari) due to improper state handling. Processing maliciously crafted web content may lead to arbitrary code execution.
Original NVD description (English source)
The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.