ZeroDay Findings
Sign inSign up

Findings

CVE-2021-30858

Apple iOS, iPadOS, macOS Use-After-Free Vulnerability

Published Aug 24, 2021 · updated Jun 16, 2026 · apple ipados

Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 24, 2021 · Catalog

    Detected

    Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Nov 17, 2021 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Required action

Apply updates per vendor instructions.

CISA due date Nov 17, 2021

Affected

  • cpe apple/ipadosversion unspecified
  • cpe apple/iphone osversion unspecified
  • cpe apple/macosversion unspecified
  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe fedoraproject/fedora33
  • cpe fedoraproject/fedora34
  • vendor Apple iOS, iPadOS, and macOSversion unspecified

Sources

  • CISA KEVCVE-2021-30858

    Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    cisa.gov
  • CVE.orgCVE-2021-30858

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-30858

    30-day exploitation probability 13.4%

    first.org
  • NIST NVDCVE-2021-30858

    A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been act

    nvd.nist.gov

References