{"id":"CVE-2021-30762","kind":"vulnerability","aliases":["CVE-2021-30762"],"related":[],"title":"Apple iOS: Apple iOS WebKit Use-After-Free Vulnerability","description":"Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Apple iOS WebKit has a use-after-free bug that is triggered when it processes maliciously crafted web content. An attacker who gets a victim to load a crafted page can run code in the browser context.","severity":"high","cvss":8.8,"epss":0.10986,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Apple iOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ios","ipad","iphone","safari","vendor","webkit"],"not_affected_if":["fully-patched-ios"],"how_to_check":"Check the iOS version on each device under Settings > General > About; the sources do not give a fixed build number.","fix":"Update iOS to the latest release per Apple's vendor instructions; CISA's required action is to apply updates per vendor instructions.","status":"open","published_at":"2021-09-08T14:15:10+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:43:22+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:43:22Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS to the latest release per Apple's vendor instructions; CISA's required action is to apply updates per vendor instructions.","reach":"internet","impact":"high","summary":"Apple iOS WebKit has a use-after-free bug that is triggered when it processes maliciously crafted web content. An attacker who gets a victim to load a crafted page can run code in the browser context.","category":"vendor","who_cares":["ios","iphone","ipad","safari","webkit"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code after the victim visits a malicious web page.","analyst_note":"Confirm the fixed iOS build numbers from Apple's security notes for CVE-2021-30762 (not in the sources); the affected and fixed fields were unknown.","how_to_check":"Check the iOS version on each device under Settings > General > About; the sources do not give a fixed build number.","needs_analyst":true,"not_affected_if":["fully-patched-ios"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000475,"input_tokens":2874,"output_tokens":376,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':12A,15A '-30762':13A,16A 'action':115C 'appl':1A,3A,26B,64C,99C,104C 'apple':17A 'appli':116C 'attack':47B 'browser':62B 'bug':35B 'cisa':113C 'code':59B,77C 'contain':67C 'content':45B,84C 'context':63B 'could':87C 'craft':43B,55B,82C 'cve':11A,14A 'execut':78C 'exploit':19B 'free':9A,34B,72C 'get':49B 'html':89C,111C 'impact':88C 'includ':94C 'instruct':120C 'io':2A,4A,20B,27B,65C 'ios':18A 'ipad':21B 'iphon':22B 'lead':75C 'limit':97C 'load':53B 'malici':42B,81C 'non':103C 'non-appl':102C 'page':56B 'parser':90C 'per':118C 'process':41B,80C,112C 'product':105C 'reli':107C 'requir':114C 'run':58B 'safari':23B,100C 'trigger':38B 'updat':117C 'use':7A,32B,70C,92C 'use-after-fre':6A,31B,69C 'vendor':24B,119C 'victim':51B 'vulner':10A,73C,86C 'web':44B,83C 'webkit':5A,25B,28B,66C,93C,109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-08T14:15:10+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-30762","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30762","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T15:39:43+00:00","note":null},{"source":"epss","external_id":"CVE-2021-30762","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30762","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-30762","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30762","severity":null,"published_at":"2021-09-08T14:15:10+00:00","modified_at":"2026-06-17T03:50:50+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}