Use‑After‑Free in Apple iOS WebKit (CVE‑2021‑30762) Enables Remote Code Execution
What It Is — Apple iOS’s WebKit rendering engine contains a use‑after‑free flaw that can be triggered by specially crafted web content, allowing an attacker to execute arbitrary code in the context of the vulnerable application.
Exploitability — The vulnerability is publicly disclosed, has a CVSS v3.1 base score of 8.8 (High), and proof‑of‑concept exploits have been observed in the wild.
Affected Products — iOS devices running versions prior to the Apple‑released patch (iOS 14.7.1 and earlier). The flaw impacts Safari and any third‑party iOS apps that embed WebKit for HTML rendering.
Why It Matters for Trust & Control Assurance
- Patch Management Discipline – Demonstrating timely remediation of critical OS flaws is a core control that maps to multiple frameworks (e.g., NIST CSF “Protect” and ISO 27001 A.12.6).
- Configuration & Asset Visibility – Continuous evidence that all managed endpoints run the approved iOS version provides a defensible audit trail.
- Supply‑Chain Assurance – Many non‑Apple apps rely on WebKit; confirming that downstream components are also patched extends the trust boundary.
Recommended Actions
- Deploy Apple’s iOS 14.7.1 (or later) update to all devices immediately.
- Verify patch rollout through your MDM/endpoint‑management solution and capture compliance evidence.
- Update your control‑mapping repository to reflect the patched state and retain the evidence for audit purposes.
Source: CISA KEV – CVE‑2021‑30762