CVE-2021-1879: Apple WebKit object lifetime flaw enables universal XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with acknowledged possible active exploitation, though the CVSS score is only 6.1 and impact is limited to low confidentiality and integrity.

What it is

Apple WebKit mishandles object lifetimes, allowing maliciously crafted web content to trigger universal cross-site scripting across iOS, iPadOS and watchOS. Apple states it is aware of a report that the issue may have been actively exploited, so unpatched devices are at real risk.

Impact

An attacker can run script in the context of other origins visited in the same WebKit instance, potentially reading data or acting as the user on affected sites. The CVSS impact is limited to low confidentiality and integrity with no availability effect.

Attack surface

Reached over the network by rendering malicious web content; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so a victim must load the crafted page. No authentication is needed.

Exploitation

Listed in CISA KEV with a 2021-11-03 addition and a 2021-11-17 remediation due date, and Apple acknowledges possible active exploitation. EPSS 30-day probability is about 7.1 percent (93.9th percentile), and references are vendor advisories plus the KEV entry.

What to do

• Update to iOS 12.5.2, iOS 14.4.2, iPadOS 14.4.2 or watchOS 7.3.3 as applicable, per Apple advisories HT212256, HT212257 and HT212258.
• Inventory Apple devices and confirm none remain on versions below the fixed releases.
• Where immediate patching is not possible, restrict browsing of untrusted web content on affected devices.
• Track KEV remediation deadlines and verify closure for internet-exposed Apple endpoints.

Detection

• Monitor for devices reporting OS versions below the fixed releases via MDM or asset inventory.
• Review web proxy or DNS logs for access to known malicious or suspicious domains around the time of suspected incidents.
• Hunt for unexpected cross-origin script activity or anomalous browser behavior on Apple devices.
• Correlate endpoint telemetry for WebKit process crashes or unusual script execution patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.