CVE‑2021‑30661: Apple WebKit Storage Use‑After‑Free Enables Remote Code Execution
What It Is – Apple disclosed a use‑after‑free flaw in the WebKit storage component that can be triggered by maliciously crafted web content. Successful exploitation grants attackers arbitrary code execution in the context of the vulnerable application.
Exploitability – The vulnerability is rated CVSS 3.1 8.8 (High). No public exploit has been observed, but the attack surface is broad because WebKit is used for HTML rendering in Safari and any third‑party browser that embeds WebKit.
Affected Products – iOS, iPadOS, macOS, tvOS, watchOS, Safari, and any non‑Apple product that relies on Apple’s WebKit engine for HTML processing.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a continuous vulnerability‑management process that can prove timely patching to auditors and partners.
- Provides a concrete example of why evidence of secure configuration (patch level, version control) must be collected and retained.
- Highlights the importance of real‑time monitoring for exploit attempts, feeding into a defensible audit trail that satisfies multiple framework controls with a single control objective.
Recommended Actions
- Verify that all Apple devices are running the latest OS version that includes the CVE‑2021‑30661 fix.
- Update any third‑party browsers that embed WebKit to the vendor‑provided patched version.
- Record patch status in your configuration‑management database to create audit‑ready evidence.
- Deploy network‑level detection rules for known WebKit exploitation patterns.
- Map the remediation to the “Vulnerability Management / Secure Configuration” control objective in your control framework.
Source: CISA KEV – CVE‑2021‑30661