HIGH

CVE-2023-23529

Apple Safari 2023-02-27 CVSS v3.1

CVSS

8.8

KEV

Description

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Summary dbcve.org

A type confusion vulnerability in WebKit (Safari's rendering engine) allows arbitrary code execution when processing maliciously crafted web content. This memory corruption flaw stems from inadequate type checking during JavaScript object handling, potentially allowing an attacker to escape the browser sandbox.

Mitigation

Apply available Apple security updates (iOS 15.7.4+/16.3.1+, iPadOS 15.7.4+/16.3.1+, macOS Ventura 13.2.1+, Safari 16.3+) to all affected devices. This is a known actively exploited zero-day; prioritize patching.

Weakness (CWE)

CWE-843 Type Confusion

EPSS Score

9.5%

Probability of exploitation in next 30 days

95.2th percentile

References

https://support.apple.com/en-us/HT213633 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213635 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213638 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213673 Release Notes, Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23529 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE