---
id: "CVE-2021-30661"
kind: "vulnerability"
aliases: ["CVE-2021-30661"]
title: "Apple Multiple Products: Apple Multiple Products WebKit Storage Use-After-Free Vulnerability"
severity: "critical"
cvss: 8.8
epss: 0.04491
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Apple Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apple", "exploited", "ios", "macos", "safari", "vendor", "webkit"]
not_affected_if: ["unpatched-builds-only"]
published_at: "2021-09-08T15:15:13+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30661", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-30661", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30661", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apple Multiple Products: Apple Multiple Products WebKit Storage Use-After-Free Vulnerability

A use-after-free bug in WebKit's storage code in Apple iOS, iPadOS, macOS, tvOS, watchOS and Safari lets a crafted web page run code. It is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks have been seen in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple Multiple Products affected ? fixed ?

## How to check

Check the installed OS and Safari versions against Apple's security release notes for CVE-2021-30661 (unknown which build fixed it in the sources).

## Fix

Update iOS, iPadOS, macOS, tvOS, watchOS and Safari to a release that includes Apple's fix (fixed version unknown in the sources).

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30661
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-30661
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-30661

## From the sources

Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_