Memory Corruption in Apple iOS WebKit (CVE‑2021‑30761) Enables Remote Code Execution
What It Is – A memory‑corruption flaw in Apple’s iOS WebKit component that can be triggered by specially crafted web content, allowing an attacker to execute arbitrary code on the device.
Exploitability – Publicly disclosed; proof‑of‑concept code exists. CVSS v3.1 base score 8.8 (High). No known active exploit campaigns, but the vulnerability is weaponizable.
Affected Products – Apple iOS devices running WebKit (Safari and any third‑party app that embeds WebKit).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a vulnerability‑management control that continuously monitors for high‑severity flaws and records remediation actions.
- Timely patching provides defensible evidence for auditors that the organization maintains an effective “patch‑and‑update” process, a control objective mapped across SOC 2, ISO 27001, NIST CSF, and others.
- Failure to remediate can erode stakeholder trust, especially when web‑based attack surfaces are involved in customer‑facing applications.
Recommended Actions
- Inventory all iOS devices and identify those running a version prior to the patch that addresses CVE‑2021‑30761.
- Deploy Apple’s latest iOS security update (iOS 14.8 / 15.2 or later) that resolves the WebKit flaw.
- Capture patch‑deployment evidence in your control repository to satisfy audit trails.
- Integrate automated vulnerability scanning for WebKit components into your continuous monitoring pipeline.
Source: CISA KEV – CVE‑2021‑30761