CVE-2023-37450
Apple Multiple Products WebKit Code Execution Vulnerability
Published Jul 13, 2023 · updated Jun 16, 2026 · apple safari
Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Timeline
Detection, updates, and resolution for this record.
Jul 13, 2023 · Catalog
Detected
Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Jul 13, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Aug 3, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Jun 16, 2026 · Catalog
Updated
Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CISA due date Aug 3, 2023
Affected
- cpe apple/ipadosversion unspecified
- cpe apple/iphone osversion unspecified
- cpe apple/macosversion unspecified
- cpe apple/safariversion unspecified
- cpe apple/tvosversion unspecified
- cpe apple/watchosversion unspecified
- cpe webkitgtk/webkitgtk+version unspecified
- vendor Apple Multiple Productsversion unspecified
Sources
- CISA KEVCVE-2023-37450
Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
cisa.gov - CVE.orgCVE-2023-37450
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-37450
30-day exploitation probability 18.9%
first.org - NIST NVDCVE-2023-37450
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively
nvd.nist.gov