{"id":"CVE-2021-30661","kind":"vulnerability","aliases":["CVE-2021-30661"],"related":[],"title":"Apple Multiple Products: Apple Multiple Products WebKit Storage Use-After-Free Vulnerability","description":"Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A use-after-free bug in WebKit's storage code in Apple iOS, iPadOS, macOS, tvOS, watchOS and Safari lets a crafted web page run code. It is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks have been seen in the wild.","severity":"critical","cvss":8.8,"epss":0.04491,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","exploited","ios","macos","safari","vendor","webkit"],"not_affected_if":["unpatched-builds-only"],"how_to_check":"Check the installed OS and Safari versions against Apple's security release notes for CVE-2021-30661 (unknown which build fixed it in the sources).","fix":"Update iOS, iPadOS, macOS, tvOS, watchOS and Safari to a release that includes Apple's fix (fixed version unknown in the sources).","status":"open","published_at":"2021-09-08T15:15:13+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:57+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:33:57Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS, iPadOS, macOS, tvOS, watchOS and Safari to a release that includes Apple's fix (fixed version unknown in the sources).","reach":"internet","impact":"high","summary":"A use-after-free bug in WebKit's storage code in Apple iOS, iPadOS, macOS, tvOS, watchOS and Safari lets a crafted web page run code. It is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks have been seen in the wild.","category":"vendor","who_cares":["apple","ios","macos","safari","webkit"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the device after the user loads malicious web content.","analyst_note":"Find Apple's security advisory for CVE-2021-30661 to confirm the fixed OS and Safari versions; the sources give no affected or fixed versions.","how_to_check":"Check the installed OS and Safari versions against Apple's security release notes for CVE-2021-30661 (unknown which build fixed it in the sources).","needs_analyst":true,"not_affected_if":["unpatched-builds-only"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00051,"input_tokens":2914,"output_tokens":437,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':15A,18A '-30661':16A,19A 'action':133C 'appl':1A,4A,23B,42B,75C,117C,122C 'apple':20A 'appli':134C 'attack':68B 'bug':35B 'catalog':66B 'cisa':61B,131C 'code':40B,56B,95C 'contain':85C 'content':102C 'could':105C 'craft':52B,100C 'cve':14A,17A 'execut':96C 'exploit':24B,64B 'free':12A,34B,90C 'html':107C,129C 'impact':106C 'includ':112C 'instruct':138C 'io':25B,43B,76C 'ipado':44B,77C 'known':63B 'lead':93C 'let':50B 'limit':115C 'list':59B 'maco':26B,45B,78C 'malici':99C 'multipl':2A,5A 'multiple':21A 'non':121C 'non-appl':120C 'page':54B 'parser':108C 'per':136C 'process':98C,130C 'product':3A,6A,123C 'products':22A 'reli':125C 'requir':132C 'run':55B 'safari':27B,49B,82C,118C 'seen':71B 'storag':8A,39B,84C 'tvos':46B,79C 'updat':135C 'use':10A,32B,88C,110C 'use-after-fre':9A,31B,87C 'vendor':28B,137C 'vulner':13A,65B,91C,104C 'watcho':47B,80C 'web':53B,101C 'webkit':7A,29B,37B,83C,111C,127C 'wild':74B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-08T15:15:13+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-30661","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30661","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2021-30661","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30661","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-30661","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30661","severity":null,"published_at":"2021-09-08T15:15:13+00:00","modified_at":"2026-06-17T03:50:38+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}