WebKit Memory Corruption Vulnerability (CVE‑2021‑30665) Impacts Apple iOS, macOS, iPadOS, watchOS, tvOS
What It Is — A memory‑corruption bug in Apple’s WebKit engine that can be triggered by specially crafted web content, leading to arbitrary code execution. The flaw is tracked as CVE‑2021‑30665 and is listed in the CISA Known Exploited Vulnerabilities catalog.
Exploitability — Publicly disclosed; proof‑of‑concept exploits have been observed. CVSS v3.1 base score 8.8 (High). No confirmed large‑scale campaign, but the vulnerability is remotely exploitable via the browser.
Affected Products — Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit (affects Safari and any third‑party app embedding WebKit).
Why It Matters for Trust & Control Assurance
- Highlights the necessity of a patch‑management control that guarantees all endpoint software is kept current.
- Continuous monitoring of patch status supplies defensible audit evidence and demonstrates due‑diligence.
- Prompt remediation shrinks the attack surface, reinforcing a risk‑based assurance posture that enterprise buyers now expect.
Recommended Actions
- Inventory devices running the affected OS versions.
- Apply Apple’s security updates that remediate CVE‑2021‑30665 immediately.
- Document patch deployment dates and retain evidence in a centralized control repository to satisfy audit requirements.
Source: CISA KEV – CVE‑2021‑30665