Vulnerability record · CVE-2021-1870 · published 2 April 2021
CVE-2021-1870: Apple WebKit logic flaw allows remote code execution
Apple · Ipados
A logic issue in Apple's WebKit was addressed with improved restrictions, affecting macOS Big Sur, Catalina, Mojave, iOS and iPadOS, plus WebKitGTK and Fedora builds. Apple states it is aware of a report that the flaw may have been actively exploited, and the CVSS vector rates it critical with no privileges or user interaction required.
Description
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCritical CVSS 9.8 with no privileges or interaction required, KEV-listed, and vendor-reported active exploitation.
What it is
A logic issue in Apple's WebKit was addressed with improved restrictions, affecting macOS Big Sur, Catalina, Mojave, iOS and iPadOS, plus WebKitGTK and Fedora builds. Apple states it is aware of a report that the flaw may have been actively exploited, and the CVSS vector rates it critical with no privileges or user interaction required.
Impact
A remote attacker can achieve arbitrary code execution on the target device, giving full compromise of confidentiality, integrity and availability.
Attack surface
Reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N), consistent with a WebKit logic flaw triggered through crafted web content.
Exploitation
Listed in CISA KEV with a 2021-11-17 remediation due date, and EPSS shows a 30-day probability of 0.0771 (94th percentile); Apple's advisory notes awareness of possible active exploitation.
What to do
- Apply the vendor updates: macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4.
- Update WebKitGTK and Fedora packages per the referenced advisories.
- Prioritize patching internet-facing and user-browsing endpoints within the KEV due date.
- Verify update deployment across all Apple devices and Linux systems carrying WebKitGTK.
Detection
- Hunt for exploitation attempts against WebKit-rendering processes on unpatched hosts.
- Monitor for unexpected code execution or process spawning from browser and WebKit processes.
- Check asset inventories for devices still below the fixed OS and WebKitGTK versions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2021-1870 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 17 November 2021.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-1870 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-1870), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
