CVE-2023-32373: Apple WebKit use-after-free enables code execution via web content

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with reported active exploitation and a high CVSS of 8.8, though it requires user interaction to trigger.

What it is

A use-after-free flaw in Apple's WebKit engine was fixed across watchOS, tvOS, macOS, iOS, iPadOS and Safari. Processing maliciously crafted web content can lead to arbitrary code execution, and Apple stated it was aware of a report that the issue may have been actively exploited.

Impact

An attacker can execute arbitrary code in the context of the affected browser or web-content renderer, potentially gaining control of the user's device or session.

Attack surface

Reached over the network by rendering malicious web content; no privileges are required but user interaction (visiting or viewing the crafted content) is needed per the CVSS vector.

Exploitation

Listed in CISA KEV with a 2023-05-22 addition and 2023-06-12 due date, and Apple reported possible active exploitation; EPSS 30-day probability is 0.12172 (95.9th percentile).

What to do

• Apply the vendor updates: watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS/iPadOS 15.7.6 and 16.5, and Safari 16.5.
• Update WebKitGTK+ and any Linux distributions carrying WebKit per their advisories (e.g. Gentoo GLSA 202401-04).
• Prioritize patching internet-facing and user-facing Apple devices and browsers, since exploitation requires only viewing crafted web content.
• Where immediate patching is not possible, restrict browsing to trusted sites and reduce exposure of unpatched devices.
• Track KEV remediation deadlines and confirm all affected platforms are covered, not just one OS.

Detection

• Monitor for crashes or abnormal process termination in WebKit-based browsers and web-content renderers.
• Hunt for unexpected child processes or code execution spawned from Safari/WebKit processes.
• Review web proxy and DNS logs for connections to known malicious or suspicious domains delivering exploit content.
• Check endpoint telemetry for memory-corruption exploitation indicators in browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.