Protect Your Apple Devices From The Three 0-Day WebKit Vulnerabilities in iOS, iPadOS, macOS. tvOS, watchOS, and Safari Web Browser

On 18th March, tech giant Apple rolled out emergency patches for their iOS, iPadOS, macOS, tvOS, watchOS, and Safari web browser platforms to protect your Apple devices from the three 0-day WebKit vulnerabilities in iOS, iPadOS, macOS, tvOS, watchOS, and Safari web browsers. According to security researchers, These WebKit vulnerabilities actively being exploited in the wild allow advisories to carry out arbitrary code execution, breach the Web Content sandbox, and sensitive information discloser attacks on vulnerable Apple devices. Apple didn’t disclose the technical details of the flaws to avoid further exploitation of the vulnerabilities. Let’s explore what Apple has shared about the three 0-Day WebKit vulnerabilities in this post.

A Short Introduction About Webkit and Web Content Sandbox

WebKit is an open-source web browser engine that is used by a variety of popular browsers, including Apple’s Safari, and formerly by Google’s Chrome until it was forked into the Blink engine in 2013.

WebKit was originally created by Apple Inc. for its Safari browser, and the name “WebKit” comes from the “khtml” and “kjs” libraries from the KDE project, which were the base technologies that WebKit was built upon.

WebKit is composed of several key components:

One of the major goals of WebKit is to be fast, efficient, and easy to embed into a variety of applications. It supports a wide range of web standards, including HTML5, CSS3, SVG, and others.

The WebKit project is a collaborative effort, with contributions from a number of companies and individuals. It is licensed under the GNU Lesser General Public License (LGPL), which means that anyone is free to use, modify, and distribute it.

The Identified Three 0-Day WebKit Vulnerabilities in Apple Devices

The three security vulnerabilities that have been identified are as follows:

CVE-2023-32409:

The WebKit Flaw: This vulnerability identified as CVE-2023-32409 is steamed from WebKit. that could potentially be exploited by a malicious actor. This flaw could allow an attacker to break out of the Web Content sandbox, a security feature that isolates web content from the rest of the system. In response, the WebKit team has implemented improved bounds checks, effectively strengthening the sandbox against such breaches.

CVE-2023-28204:

The second vulnerability, CVE-2023-28204, is an out-of-bounds read issue within WebKit. This flaw could be abused to disclose sensitive information during the processing of web content. To address this, the WebKit team has enhanced input validation, thereby reducing the potential for sensitive data exposure.

CVE-2023-32373:

The third identified vulnerability, CVE-2023-32373, is a use-after-free bug within WebKit. This bug could potentially lead to arbitrary code execution when processing maliciously crafted web content. To rectify this, the WebKit team has improved memory management, significantly reducing the risk of arbitrary code execution.

Note: the CVE-2023-32409 vulnerability is reported by Clément Lecigne of Google’s Threat Analysis Group (TAG) and Donncha Ó Cearbhaill of Amnesty International’s Security Lab. The other two vulnerabilities are reported by an anonymous researcher.

Apple Devices Vulnerable to These Three 0-Day WebKit Vulnerabilities

These vulnerabilities affect most likely every Apple devices which run these below versions.

How to Protect Your Apple Devices From The Three 0-Day WebKit Vulnerabilities?

Apple released emergency patches in that it says it has released iOS 16.5, iPadOS 16.5 macOS Ventura 13.4, and Safari 16.5, watchOS 9.5, and safari 16.5 to fix the flaw. We recommend all users of iPhones, iPad, and MacBooks, Apple Watch, and Apple TV should upgrade their OS to the latest release. Please visit the Apple security updates page to read information about all the recently released security updates.

Versions patched these three 0-day WebKit vulnerabilities are:

Follow these steps to check for updates on your devices:

We hope this post will help you know how to protect your Apple devices from the three 0-Day WebKit vulnerabilities in iOS, iPadOS, macOS, tvOS, watchOS, and Safari Web Browsers. Please share this post if you find this interested. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr,  Medium, and Instagram and subscribe to receive updates like this.

You may also like these articles: