Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

WebKit can run malicious code from crafted web pages

CVE-2024-23222 · published 2 years ago · actively exploited
Summary

Apple's WebKit component used in iOS, iPadOS, macOS, tvOS and Safari can be tricked into running unwanted code when it processes specially crafted web content. This could let attackers take control of the device or steal data through the web browser or any app that relies on WebKit. Install the latest software updates from Apple as soon as they are available to apply the fix.

What to do
  • Update debian webkit2gtk to version 2.42.5-1~deb11u1.
  • Update debian webkit2gtk to version 2.42.5-1~deb12u1.
  • Update debian webkit2gtk to version 2.42.5-1.
  • Update debian wpewebkit to version 2.42.5-1.
  • Update canonical webkit2gtk to version 2.42.5-0ubuntu0.22.04.2.
  • Update apple tvos to version 17.3 or later.
  • Update apple visionos to version 1.0.2 or later.
  • Update apple safari to version 17.3 or later.
Affected software
Ecosystem VendorProductAffected versions
– apple multiple products All versions
– apple ipados < 16.7.5
>= 17.0, < 17.3
< 15.8.7
>= 16.0, < 16.7.5
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
– apple iphone_os < 16.7.5
>= 17.0, < 17.3
< 15.8.7
>= 16.0, < 16.7.5
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
– apple macos < 12.7.3
>= 13.0, < 13.6.4
>= 14.0, < 14.3
>= 12.0, < 12.7.3
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
– apple tvos < 17.3
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
– apple visionos < 1.0.2
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
Debian:11 debian webkit2gtk < 2.42.5-1~deb11u1
Fix: upgrade to 2.42.5-1~deb11u1
Debian:12 debian webkit2gtk < 2.42.5-1~deb12u1
Fix: upgrade to 2.42.5-1~deb12u1
Debian:13 debian webkit2gtk < 2.42.5-1
Fix: upgrade to 2.42.5-1
Debian:14 debian webkit2gtk < 2.42.5-1
Fix: upgrade to 2.42.5-1
Debian:11 debian wpewebkit All versions
Debian:12 debian wpewebkit All versions
Debian:13 debian wpewebkit < 2.42.5-1
Fix: upgrade to 2.42.5-1
Debian:14 debian wpewebkit < 2.42.5-1
Fix: upgrade to 2.42.5-1
– apple safari < 17.3
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
Ubuntu:16.04:LTS canonical qtwebkit-opensource-src All versions
Ubuntu:16.04:LTS canonical webkit2gtk All versions
Ubuntu:16.04:LTS canonical qtwebkit-source All versions
Ubuntu:16.04:LTS canonical webkitgtk All versions
Ubuntu:18.04:LTS canonical webkit2gtk All versions
Ubuntu:18.04:LTS canonical qtwebkit-opensource-src All versions
Ubuntu:18.04:LTS canonical qtwebkit-source All versions
Ubuntu:18.04:LTS canonical webkitgtk All versions
Ubuntu:20.04:LTS canonical webkit2gtk All versions
Ubuntu:20.04:LTS canonical qtwebkit-opensource-src All versions
Ubuntu:20.04:LTS canonical wpewebkit All versions
Ubuntu:22.04:LTS canonical qtwebkit-opensource-src All versions
Ubuntu:22.04:LTS canonical webkit2gtk < 2.42.5-0ubuntu0.22.04.2
Fix: upgrade to 2.42.5-0ubuntu0.22.04.2
Ubuntu:22.04:LTS canonical wpewebkit All versions
Ubuntu:24.04:LTS canonical qtwebkit-opensource-src All versions
Original advisory text
Apple Multiple Products WebKit Type Confusion Vulnerability
Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
References
Fix within
Internet-facing 3 days
and check for signs of compromise
Internal 14 days
  • Known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
11% chance of attack within 30 days
Type
CWE-843Type Confusion
Timeline
Published23 Jan 2024
Updated2 Nov 2026
First seen6 Mar 2026
Sources
CVE-2024-23222 · CISA KEV
CVE-2024-23222 · NVD
DEBIAN-CVE-2024-23222 · OSV
UBUNTU-CVE-2024-23222 · OSV
Track software like this
Free during beta