CVE-2018-4233: Apple WebKit memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote code execution with high EPSS and public exploit code, but exploitation requires user interaction and no KEV listing.

What it is

WebKit in multiple Apple products contains a memory corruption flaw (CWE-119) that can be triggered by a crafted web site. It affects iOS, Safari, iCloud and iTunes on Windows, tvOS, and watchOS, and also Ubuntu Linux builds. Successful exploitation can lead to arbitrary code execution or a denial of service.

Impact

An attacker who gets a victim to load a malicious page can execute arbitrary code in the context of the affected browser or app, or crash it. Given the CVSS impact ratings, code execution could allow full compromise of confidentiality, integrity, and availability on the target.

Attack surface

Reached over the network through a crafted web site rendered by WebKit; the CVSS vector shows no privileges required but user interaction is required, meaning the victim must visit or open the malicious content. No authentication is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.53337, 98.9th percentile) and an Exploit-DB entry exists, indicating public exploit code is available. No ransomware group usage is documented.

What to do

• Update to the fixed versions: iOS 11.4, Safari 11.1.1, iCloud 7.5 on Windows, iTunes 12.7.5 on Windows, tvOS 11.4, watchOS 4.3.1, or later.
• Apply the Ubuntu WebKit security update referenced in USN-3687-1 for affected Ubuntu systems.
• Restrict or block untrusted web content and enforce safe browsing controls on managed Apple devices.
• Keep WebKit-based browsers and embedded web views patched through centralized patch management.

Detection

• Monitor for crashes of WebKit-based processes (Safari, WebKit, iCloud, iTunes) that correlate with browsing activity.
• Hunt for exploit-db 45998 or related WebKit proxy object type confusion indicators in proxy, DNS, or endpoint logs.
• Review endpoint telemetry for unexpected child processes spawned by browser or WebKit processes.
• Track patch compliance for the affected Apple and Ubuntu product versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.