ZeroDay Findings
Sign inSign up

Findings

CVE-2023-28205

Apple Multiple Products WebKit Use-After-Free Vulnerability

Published Apr 10, 2023 · updated Jun 16, 2026 · apple safari

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 10, 2023 · Catalog

    Detected

    A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

  2. Apr 10, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 1, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Required action

Apply updates per vendor instructions.

CISA due date May 1, 2023

Affected

  • cpe apple/ipadosversion unspecified
  • cpe apple/iphone osversion unspecified
  • cpe apple/macosversion unspecified
  • cpe apple/safariversion unspecified
  • vendor Apple Multiple Productsversion unspecified

Sources

  • CISA KEVCVE-2023-28205

    Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    cisa.gov
  • CVE.orgCVE-2023-28205

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-28205

    30-day exploitation probability 27.1%

    first.org
  • NIST NVDCVE-2023-28205

    A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is

    nvd.nist.gov

References