---
id: "CVE-2021-30761"
kind: "vulnerability"
aliases: ["CVE-2021-30761"]
title: "Apple iOS: Apple iOS WebKit Memory Corruption Vulnerability"
severity: "high"
cvss: 8.8
epss: 0.10545
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Apple iOS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ios", "ipad", "iphone", "safari", "vendor", "webkit"]
not_affected_if: ["up-to-date-ios"]
published_at: "2021-09-08T14:15:10+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30761", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-30761", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30761", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apple iOS: Apple iOS WebKit Memory Corruption Vulnerability

Apple iOS WebKit has a memory corruption bug that is triggered by processing maliciously crafted web content. An attacker who gets a victim to load a booby-trapped page can run code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple iOS affected ? fixed ?

## How to check

Settings > General > About on the iPhone or iPad shows the iOS version; compare it with the fixed release listed by Apple.

## Fix

Update iOS to the release Apple lists as fixing CVE-2021-30761 (CISA says: apply updates per vendor instructions).

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30761
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-30761
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-30761

## From the sources

Apple iOS WebKit contains a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_