Use-After-Free in Apple WebKit (CVE‑2021‑30858) Enables Remote Code Execution on iOS, iPadOS, macOS
What It Is — Apple’s WebKit component in iOS, iPadOS, and macOS contains a use‑after‑free flaw that can be triggered by malicious web content, allowing an attacker to execute arbitrary code in the victim’s browser. The vulnerability is tracked as CVE‑2021‑30858.
Exploitability — Publicly disclosed; proof‑of‑concept code exists. CVSS v3.1 base score 8.8 (High). No confirmed active exploits in the wild, but the attack surface is broad because WebKit underpins Safari and any third‑party app that embeds it.
Affected Products — Apple iOS 14.8, iPadOS 14.8, macOS Big Sur 11.6 and later versions that include the vulnerable WebKit build. Non‑Apple browsers that embed WebKit (e.g., certain Electron‑based apps) are also at risk.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a robust vulnerability‑management control that continuously inventories software versions and validates patch status across all endpoints.
- Highlights the importance of evidence‑driven patch‑deployment processes that can be audited to prove timely remediation to regulators or enterprise customers.
- Reinforces that continuous control monitoring of third‑party components (e.g., embedded WebKit) is a key trust signal for buyers demanding defensible security postures.
Recommended Actions
- Verify the WebKit version on all managed iOS, iPadOS, and macOS devices; cross‑reference against Apple’s security advisory.
- Deploy the latest Apple security updates (iOS 15.4, iPadOS 15.4, macOS 12.3 or later) that contain the fix.
- Update any third‑party applications that bundle WebKit to the vendor‑provided patched version.
- Record patch‑deployment evidence in your control repository to satisfy audit requirements.
Source: CISA KEV – CVE‑2021‑30858