CVE-2022-22620: Apple WebKit use-after-free allows code execution via crafted web content

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely reachable, leads to arbitrary code execution, is listed in CISA KEV with confirmed active exploitation, and has a high EPSS percentile, though it requires user interaction and patches have long been available.

What it is

A use-after-free flaw in Apple's WebKit engine was addressed with improved memory management. Processing maliciously crafted web content can lead to arbitrary code execution, and Apple stated it was aware of a report that the issue may have been actively exploited. It affects Safari, iOS, iPadOS and macOS.

Impact

An attacker who gets a victim to load crafted web content can execute arbitrary code in the context of the affected browser or WebKit-based component, giving full compromise of confidentiality, integrity and availability on the device.

Attack surface

Reached over the network by delivering malicious web content to a WebKit-based browser or embedded WebView; no authentication is required, but user interaction (loading the page) is needed per the CVSS vector.

Exploitation

Listed in CISA KEV with a 2022-02-25 remediation due date, and Apple acknowledged a report of active exploitation; EPSS 30-day probability is about 16.3 percent (96.8th percentile).

What to do

• Update to the fixed versions: macOS Monterey 12.2.1, iOS 15.3.1, iPadOS 15.3.1, and Safari 15.3 (16612.4.9.1.8 / 15612.4.9.1.8) or later.
• Apply the vendor updates per CISA KEV required action and track remediation against the 2022-02-25 due date.
• Prioritize patching internet-facing and user-facing Apple devices, including those running WebKit-based embedded browsers.
• Where immediate patching is not possible, restrict browsing to trusted sites and reduce exposure of unmanaged devices.
• Monitor Gentoo GLSA 202208-39 guidance for any non-Apple WebKit packaging in use.

Detection

• Hunt for crashes or abnormal process termination in Safari, WebKit, or WebContent processes that could indicate use-after-free exploitation attempts.
• Review web proxy, DNS and browser telemetry for access to known exploit or malvertising infrastructure around the time of suspected incidents.
• Monitor for unexpected child processes or code execution spawned from browser or WebKit processes on affected Apple endpoints.
• Check endpoint inventories for devices still below the fixed OS and Safari versions listed in the Apple advisories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.