Vulnerability record · CVE-2022-42856 · published 15 December 2022
CVE-2022-42856: Apple WebKit type confusion allows code execution via crafted web content
Apple · Safari
A type confusion flaw in Apple's WebKit engine was fixed through improved state handling in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS/iPadOS 15.7.2 and iOS 16.1.2. Processing maliciously crafted web content can lead to arbitrary code execution, and Apple stated it was aware of a report that the issue may have been actively exploited against iOS versions before 15.1.
Description
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is in CISA KEV with reported active exploitation and a high CVSS score of 8.8, but requires user interaction and has a moderate EPSS probability.
What it is
A type confusion flaw in Apple's WebKit engine was fixed through improved state handling in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS/iPadOS 15.7.2 and iOS 16.1.2. Processing maliciously crafted web content can lead to arbitrary code execution, and Apple stated it was aware of a report that the issue may have been actively exploited against iOS versions before 15.1.
Impact
An attacker who gets a victim to load crafted web content can execute arbitrary code in the context of the affected browser or WebKit-based component, with high impact to confidentiality, integrity and availability.
Attack surface
Reached over the network through maliciously crafted web content rendered by WebKit; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so a victim must open or view the crafted content.
Exploitation
The vulnerability is listed in CISA KEV (added 2022-12-14) and Apple stated it may have been actively exploited against iOS versions before 15.1; EPSS 30-day probability is 0.08523 (94.8th percentile).
What to do
- Apply Apple's fixed releases: Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS/iPadOS 15.7.2 and iOS 16.1.2, per vendor instructions.
- Prioritize updating internet-facing and user-facing Apple devices, especially iPhones and iPads still on versions before 15.1.
- Enforce managed update policies and verify patch compliance for Safari, iOS/iPadOS, macOS and tvOS across the fleet.
- Restrict or monitor browsing of untrusted web content on unpatched devices until updates are applied.
Detection
- Hunt for devices reporting OS or Safari versions below the fixed releases listed in Apple advisories HT213516, HT213531, HT213532, HT213535 and HT213537.
- Monitor endpoint and network telemetry for browser or WebKit process crashes followed by unexpected child processes or code execution.
- Review proxy and DNS logs for access to known malicious or exploit-hosting domains on Apple devices that have not been updated.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-42856 to the Known Exploited Vulnerabilities catalog on 14 December 2022 as "Apple iOS Type Confusion Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 4 January 2023.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-42856 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-42856), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
