CVE-2023-37450
Apple Multiple Products WebKit Code Execution Vulnerability
Description
CVE-2023-37450 is a vulnerability in Apple's WebKit engine that allows arbitrary code execution when processing malicious web content. This vulnerability affects multiple Apple products including Safari, iOS, iPadOS, macOS Ventura, tvOS, and watchOS, as well as the open-source WebKitGTK+ library. An attacker can craft web content that, when processed by a victim's browser or application, triggers arbitrary code execution on the device. Apple has acknowledged that CVE-2023-37450 may have been actively exploited prior to the release of patches, and CISA has added it to the Known Exploited Vulnerabilities catalog. With a CVSS score of 8.8 (High severity), this WebKit vulnerability poses a serious security risk to users across Apple's entire ecosystem.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 16.5.2 |
| apple | ipados | < 16.6 |
| apple | iphone os | < 16.6 |
| apple | macos | >= 13.0, < 13.5 |
| apple | tvos | < 16.6 |
| apple | watchos | < 9.6 |
| webkitgtk | webkitgtk\+ | < 2.42.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://security.gentoo.org/glsa/202401-04(Third Party Advisory)
- https://support.apple.com/en-us/HT213826(Vendor Advisory)
- https://support.apple.com/en-us/HT213841(Vendor Advisory)
- https://support.apple.com/en-us/HT213843(Vendor Advisory)
- https://support.apple.com/en-us/HT213846(Vendor Advisory)
- https://support.apple.com/en-us/HT213848(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-37450(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2023-37450 by NVD. The vulnerability is described as an issue with insufficient checks in WebKit's processing of web content, leading to arbitrary code execution. This type of flaw typically relates to memory safety or input validation weaknesses in the browser engine.
Impact Analysis
CVE-2023-37450 is remotely exploitable without physical access, as the attack vector is network-based. The vulnerability is easy to exploit with no special conditions needed and requires no authentication, though user interaction is required — a victim must visit a malicious web page or process attacker-controlled web content. Confidentiality (High): A successful exploit allows the attacker to access sensitive data on the device, including personal files, credentials, browsing data, and application information. Integrity (High): Arbitrary code execution enables the attacker to modify files, install malware, and alter system behavior on the compromised device. Availability (High): The attacker can crash applications, disrupt device functionality, or render services unavailable. With a CVSS score of 8.8 (High severity), this vulnerability affects the core rendering engine shared across Safari, iOS, macOS, tvOS, and watchOS, meaning a single exploit can target billions of Apple devices worldwide. Despite the low EPSS score of 0.02%, CISA's KEV listing and Apple's acknowledgment of active exploitation confirm that this is a real-world threat.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-37450 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 3, 2023. Apple has also acknowledged that this issue may have been actively exploited prior to patching. While the EPSS score of 0.02% is low and no public exploit code appears in the NVD references, the confirmed active exploitation by CISA and Apple indicates that sophisticated threat actors have developed working exploits for this WebKit vulnerability, likely for use in targeted attacks rather than widespread campaigns.
Remediation
- Apply Apple security updates immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Install iOS 16.6, iPadOS 16.6, Safari 16.5.2, macOS Ventura 13.5, tvOS 16.6, and watchOS 9.6 from the respective Apple security advisories (HT213826, HT213841, HT213843, HT213846, HT213848).
- Update WebKitGTK+ on Linux systems that use the library for web rendering. Refer to the Gentoo security advisory GLSA 202401-04 for distribution-specific patch instructions.
- Enable automatic updates on all Apple devices to ensure timely delivery of security patches. For managed environments, use MDM solutions to push the required updates to all enrolled devices.
- Implement web content filtering to block access to known malicious domains and implement browser isolation technologies where feasible, reducing the risk of users encountering exploit-laden web content.
- Monitor for indicators of compromise on endpoints, particularly unusual WebKit process behavior, unexpected code execution, or suspicious network connections following web browsing activity. Review device logs for signs of exploitation.
Technical Details
CVE-2023-37450 is a vulnerability in Apple's WebKit browser engine stemming from insufficient validation checks when processing web content. The flaw allows a remote attacker to craft malicious web content that, when rendered by the WebKit engine, triggers arbitrary code execution on the victim's device. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-based attack with low complexity and no privileges required, though user interaction is necessary — the victim must navigate to or be directed to a page serving the malicious content. The scope is unchanged, meaning the impact remains within the context of the WebKit process, though with high impact across confidentiality, integrity, and availability, an attacker can potentially escape the browser sandbox depending on the specific exploitation technique. The vulnerability is particularly impactful because WebKit is the mandatory rendering engine for all browsers on iOS and is used by Safari across all Apple platforms.
Frequently Asked Questions
Is CVE-2023-37450 being actively exploited?
Yes, CVE-2023-37450 has been actively exploited. CISA has added it to the Known Exploited Vulnerabilities catalog, and Apple has acknowledged reports of active exploitation prior to patching. The exploitation appears to be targeted rather than widespread, as indicated by the low EPSS score of 0.02%.
What products are affected by CVE-2023-37450?
CVE-2023-37450 affects Apple Safari, iOS and iPadOS (versions prior to 16.6), macOS Ventura (versions prior to 13.5), tvOS (versions prior to 16.6), watchOS (versions prior to 9.6), and the open-source WebKitGTK+ library. Essentially any application or platform that uses Apple's WebKit rendering engine is potentially affected.
How do I fix CVE-2023-37450?
Update all Apple devices to the latest patched versions: iOS 16.6, iPadOS 16.6, Safari 16.5.2, macOS Ventura 13.5, tvOS 16.6, and watchOS 9.6. For Linux systems using WebKitGTK+, apply the distribution-specific security updates. Enable automatic updates to ensure future patches are applied promptly.
How severe is CVE-2023-37450?
CVE-2023-37450 is rated High severity with a CVSS score of 8.8 out of 10. While the EPSS score is relatively low at 0.02%, the vulnerability has been confirmed as actively exploited by both CISA and Apple. The broad impact across Apple's entire device ecosystem — iPhones, iPads, Macs, Apple TVs, and Apple Watches — makes this a high-priority vulnerability to address.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.