CVE-2023-32439: Apple WebKit type confusion allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability, KEV listing and vendor confirmation of possible active exploitation make this a high-priority patch despite requiring user interaction.

What it is

A type confusion flaw in WebKit was fixed by improved checks in iOS 16.5.1, iPadOS 16.5.1, iOS 15.7.7, iPadOS 15.7.7, macOS Ventura 13.4.1 and Safari 16.5.1. Processing maliciously crafted web content can lead to arbitrary code execution, and Apple states it is aware of a report that the issue may have been actively exploited. It matters because the affected component is the browser engine used across Apple platforms and WebKitGTK.

Impact

An attacker can execute arbitrary code in the context of the affected browser or app rendering the malicious web content, with high confidentiality, integrity and availability impact per the CVSS vector.

Attack surface

Reached over the network by getting a victim to process maliciously crafted web content; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N). No authentication is needed.

Exploitation

Listed in CISA KEV with a due date of 2023-07-14, and Apple states the issue may have been actively exploited; EPSS 30-day probability is about 23.8 percent (97.7th percentile). No ransomware campaign use is recorded.

What to do

• Apply the vendor updates: iOS 16.5.1/iPadOS 16.5.1, iOS 15.7.7/iPadOS 15.7.7, macOS Ventura 13.4.1 and Safari 16.5.1, per Apple advisories.
• Update WebKitGTK packages using the Gentoo GLSA 202401-04 guidance where applicable.
• Prioritize patching internet-facing and user-browsing endpoints first, given KEV listing and active exploitation reporting.
• If immediate patching is not possible, reduce exposure by restricting browsing of untrusted web content on unpatched devices.
• Track KEV remediation deadlines and verify all affected Apple and WebKitGTK assets are updated.

Detection

• Hunt for crashes or abnormal process terminations in WebKit-based browsers and WebContent processes on unpatched Apple devices.
• Monitor for unexpected child processes or code execution spawned from Safari, WebKit or WebContent processes.
• Review web proxy and DNS logs for access to known malicious or exploit-hosting domains tied to WebKit exploitation.
• Check endpoint inventory for devices still running versions below the fixed releases listed in the Apple advisories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.