{"id":"CVE-2021-1879","kind":"vulnerability","aliases":["CVE-2021-1879"],"related":[],"title":"Apple iOS, iPadOS, and watchOS: Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability","description":"Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A WebKit flaw in Apple iOS, iPadOS and watchOS lets crafted web content run script in pages it should not reach. Attackers can use it to read data and act as the user in other sites, and CISA lists it as actively exploited.","severity":"high","cvss":6.1,"epss":0.07082,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Apple iOS, iPadOS, and watchOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ios","ipados","safari","vendor","watchos","webkit"],"not_affected_if":["unpatched-os-versions-only"],"how_to_check":"Settings > General > About on each iPhone, iPad or Apple Watch and compare the version with Apple's patched release notes","fix":"Update iOS, iPadOS and watchOS to a release that includes the fix, per Apple's security release notes for CVE-2021-1879\nApps that embed WebKit (non-Safari browsers and in-app web views) also need their own updates","status":"open","published_at":"2021-04-02T19:15:20+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:08+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:37:08Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS, iPadOS and watchOS to a release that includes the fix, per Apple's security release notes for CVE-2021-1879\nApps that embed WebKit (non-Safari browsers and in-app web views) also need their own updates","reach":"internet","impact":"high","summary":"A WebKit flaw in Apple iOS, iPadOS and watchOS lets crafted web content run script in pages it should not reach. Attackers can use it to read data and act as the user in other sites, and CISA lists it as actively exploited.","category":"vendor","who_cares":["ios","ipados","watchos","safari","webkit"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker script runs in victim web pages, reading session data and actions","analyst_note":"Find the exact fixed iOS, iPadOS and watchOS versions in Apple's security notes for CVE-2021-1879 and confirm the exploitation details in the CISA KEV entry.","how_to_check":"Settings > General > About on each iPhone, iPad or Apple Watch and compare the version with Apple's patched release notes\nunknown\nunknown","needs_analyst":true,"not_affected_if":["unpatched-os-versions-only"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000522,"input_tokens":2940,"output_tokens":456,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1879':20A,23A '-2021':19A,22A 'act':65B 'action':134C 'activ':77B 'allow':90C 'and':27A 'appl':1A,6A,40B,79C,118C,123C 'apple':24A 'appli':135C 'attack':57B 'cisa':73B,132C 'contain':85C 'content':48B,103C 'could':106C 'craft':46B,101C 'cross':13A,94C 'cross-sit':12A,93C 'cve':18A,21A 'data':63B 'exploit':29B,78B 'flaw':38B 'html':108C,130C 'impact':107C 'includ':113C 'instruct':139C 'io':2A,7A,30B,41B,80C 'ios':25A 'ipado':3A,8A,31B,42B,81C 'ipados':26A 'let':45B 'limit':116C 'list':74B 'malici':100C 'non':122C 'non-appl':121C 'page':52B 'parser':109C 'per':137C 'process':99C,131C 'product':124C 'reach':56B 'read':62B 'reli':126C 'requir':133C 'run':49B 'safari':32B,119C 'script':15A,50B,96C 'site':14A,71B,95C 'univers':92C 'unspecifi':87C 'updat':136C 'use':59B,111C 'user':68B 'vendor':33B,138C 'vulner':17A,88C,105C 'watcho':5A,10A,34B,44B,83C 'watchos':28A 'web':47B,102C 'webkit':11A,35B,37B,84C,112C,128C 'xss':16A,97C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-04-02T19:15:20+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-1879","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-1879","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T15:39:43+00:00","note":null},{"source":"epss","external_id":"CVE-2021-1879","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-1879","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-1879","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-1879","severity":null,"published_at":"2021-04-02T19:15:20+00:00","modified_at":"2026-06-17T03:32:42+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}