Arbitrary Code Execution Vulnerability in Apple JavaScriptCore (CVE‑2022‑48503) Impacts macOS, iOS, tvOS, Safari & watchOS
What It Is – An unspecified flaw in Apple’s JavaScriptCore engine can be triggered by crafted web content and may lead to arbitrary code execution on macOS, iOS, tvOS, Safari and watchOS devices.
Exploitability – The vulnerability is classified as “Exploitable” by CISA’s Known Exploited Vulnerabilities (KEV) catalog; no public proof‑of‑concept is required because any malicious web page can invoke the flaw.
Affected Products – Apple macOS, iOS, tvOS, Safari, and watchOS (including versions that may already be end‑of‑life or end‑of‑service).
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for continuous monitoring of vendor‑issued patches and a documented remediation workflow that can be audited.
- Evidence of Due Diligence – Maintaining up‑to‑date proof that vulnerable endpoints have been patched (or de‑commissioned) satisfies control objectives across NIST CSF, ISO 27001 and other frameworks.
- Defensible Audit Trail – Recording patch status, exception handling, and end‑of‑life retirements creates a traceable record for regulators and enterprise buyers demanding “trust‑by‑evidence.”
Recommended Actions
- Inventory all Apple devices in scope and map their OS versions against the CVE‑2022‑48503 advisory.
- Apply Apple’s security update that addresses the JavaScriptCore flaw; if no patch exists for an EoL/EoS version, isolate or retire the device.
- Log the remediation step in your vulnerability‑management system and retain the patch‑release documentation as audit evidence.
- Enable web‑content filtering or Content Security Policy (CSP) rules to limit execution of untrusted JavaScript while awaiting remediation.
- Review your control‑mapping repository to ensure the “Patch Management” control objective is fully evidenced.
Source: CISA KEV – CVE‑2022‑48503