CVE-2023-43000: Apple WebKit use-after-free via malicious web content

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with an exploit-tagged reference and high CVSS impact, though exploitation requires user interaction and the EPSS score is moderate.

What it is

A use-after-free flaw in Apple's WebKit engine was fixed by improved memory management in macOS Ventura 13.5, iOS/iPadOS 16.6, Safari 16.6, and iOS/iPadOS 15.8.7. Processing maliciously crafted web content can corrupt memory, and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog, so it is being used in real attacks.

Impact

An attacker who gets a victim to load crafted web content can trigger memory corruption, which in a browser engine typically enables code execution in the context of the browser or device. The CVSS vector rates high confidentiality, integrity, and availability impact.

Attack surface

Reached over the network by serving malicious web content; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), meaning a victim must open or view the crafted page. No authentication is needed.

Exploitation

CISA added it to KEV with a due date of 2026-03-26, and a Google Threat Intelligence reference is tagged as an exploit, indicating observed exploitation. EPSS 30-day probability is about 3.9 percent (89.7th percentile), so mass scanning is not the main signal; KEV status is.

What to do

• Update to the fixed versions: macOS Ventura 13.5, iOS/iPadOS 16.6, Safari 16.6, or iOS/iPadOS 15.8.7 as applicable.
• Apply the vendor mitigations in Apple's release notes for devices that cannot be updated immediately.
• Follow CISA BOD 22-01 guidance for cloud services and discontinue use of unpatchable affected products.
• Restrict or monitor browsing of untrusted links on unpatched Apple devices.
• Track KEV remediation deadlines and confirm all affected endpoints are patched before 2026-03-26.

Detection

• Hunt for crashes or memory-corruption events in Safari, WebKit, or related processes on Apple devices.
• Monitor network and proxy logs for known exploit-kit delivery patterns and suspicious web content reaching Apple devices.
• Review endpoint telemetry for unexpected code execution or process behavior originating from browser processes.
• Check patch and version inventory for Apple devices still below the fixed releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.