---
id: "CVE-2021-30762"
kind: "vulnerability"
aliases: ["CVE-2021-30762"]
title: "Apple iOS: Apple iOS WebKit Use-After-Free Vulnerability"
severity: "high"
cvss: 8.8
epss: 0.10986
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Apple iOS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ios", "ipad", "iphone", "safari", "vendor", "webkit"]
not_affected_if: ["fully-patched-ios"]
published_at: "2021-09-08T14:15:10+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30762", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-30762", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30762", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apple iOS: Apple iOS WebKit Use-After-Free Vulnerability

Apple iOS WebKit has a use-after-free bug that is triggered when it processes maliciously crafted web content. An attacker who gets a victim to load a crafted page can run code in the browser context.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple iOS affected ? fixed ?

## How to check

Check the iOS version on each device under Settings > General > About; the sources do not give a fixed build number.

## Fix

Update iOS to the latest release per Apple's vendor instructions; CISA's required action is to apply updates per vendor instructions.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30762
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-30762
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-30762

## From the sources

Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_