CVE-2021-30762: Apple iOS WebKit use-after-free enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed active exploitation and a high CVSS score, but it requires user interaction and affects an older iOS release that most current devices have already patched.

What it is

CVE-2021-30762 is a use-after-free flaw in Apple iOS WebKit memory handling, fixed in iOS 12.5.4. Processing maliciously crafted web content can lead to arbitrary code execution, and Apple stated it was aware of a report that the issue may have been actively exploited. The record does not name the specific WebKit component or affected device models beyond iPhone OS.

Impact

An attacker who gets a victim to load crafted web content can execute arbitrary code in the context of the browser or web-rendering process. Given the CVSS impact ratings of high for confidentiality, integrity and availability, this can lead to full compromise of the affected device's user data and code execution.

Attack surface

Reached over the network via maliciously crafted web content, with the CVSS vector requiring user interaction (UI:R) and no privileges (PR:N). No authentication is needed; the victim must browse to or load the attacker's content.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, and Apple stated it was aware of a report of active exploitation. EPSS gives a 30-day probability of about 11 percent (95.7th percentile), and no ransomware campaign use is documented.

What to do

• Update to iOS 12.5.4 or later per Apple's advisory HT212548; this is the only complete fix.
• Inventory devices still running iOS versions below 12.5.4, including older iPhones and iPads that may be out of normal update cycles.
• Restrict or block access to untrusted web content on unpatched devices where updating is not immediately possible.
• Apply the CISA KEV required action and track remediation against the 2021-11-17 due date for covered federal systems.

Detection

• Monitor for crashes or abnormal termination of WebKit/WebContent processes on iOS devices, which can accompany use-after-free exploitation.
• Review web proxy or DNS logs for access to known malicious or exploit-hosting domains from iOS devices.
• Hunt for unexpected code execution or persistence artifacts on iOS endpoints, though iOS telemetry is limited without MDM or EDR coverage.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.