CVE-2021-30858: Apple WebKit use-after-free allows code execution via crafted web content

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows remote code execution with user interaction, is listed in CISA KEV with known exploitation, and has a high EPSS percentile, though it requires the victim to load crafted content.

What it is

A use-after-free flaw in Apple's web content processing was fixed in iOS 14.8, iPadOS 14.8 and macOS Big Sur 11.6. Processing maliciously crafted web content can lead to arbitrary code execution, and Apple stated it was aware of a report that the issue may have been actively exploited.

Impact

An attacker can execute arbitrary code in the context of the affected device or browser process, with high impact to confidentiality, integrity and availability. This can lead to full compromise of the user's session and data on the vulnerable system.

Attack surface

Reached over the network by delivering malicious web content to the victim; the CVSS vector shows no privileges required but user interaction required, meaning the victim must load or view the crafted content. No authentication is needed.

Exploitation

The issue is listed in CISA KEV with a 2021-11-03 addition and a 2021-11-17 remediation due date, and Apple stated it may have been actively exploited. EPSS 30-day probability is 0.13427 (96th percentile), indicating elevated likelihood; no ransomware campaign use is documented.

What to do

• Apply Apple updates to iOS 14.8, iPadOS 14.8 and macOS Big Sur 11.6 or later as instructed by the vendor.
• Apply the corresponding Fedora and Debian security updates referenced in the advisory lists.
• Enforce prompt patching of Apple devices and browsers that embed the affected web engine.
• Restrict or monitor browsing of untrusted web content on unpatched devices where patching is delayed.

Detection

• Monitor for crashes or abnormal process termination in WebKit or browser processes on Apple devices.
• Hunt for exploitation indicators such as unexpected child processes spawned by browser or web content processes.
• Review endpoint telemetry for code execution or memory corruption behavior originating from browser sessions.
• Track patch compliance for iOS, iPadOS and macOS against the fixed versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.