{"id":"CVE-2021-30858","kind":"vulnerability","aliases":["CVE-2021-30858"],"related":[],"title":"Apple iOS, iPadOS, and macOS: Apple iOS, iPadOS, macOS Use-After-Free Vulnerability","description":"Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A use-after-free bug in Apple's WebKit engine lets a crafted web page run code when processed by iOS, iPadOS, or macOS. It is listed as actively exploited in the wild.","severity":"critical","cvss":8.8,"epss":0.13379,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Apple iOS, iPadOS, and macOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","exploited","ios","ipados","macos","safari","vendor","webkit"],"not_affected_if":["unpatched-devices-not-present"],"how_to_check":"Check the installed OS version under Settings > General > About (iOS/iPadOS) or About This Mac (macOS) and compare it with the patched release in Apple's security notes.","fix":"Update iOS, iPadOS, and macOS to a release that includes Apple's fix, per vendor instructions.\nApps that embed WebKit should also be updated to a patched WebKit build.","status":"open","published_at":"2021-08-24T19:15:14+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:32:08+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:32:08Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS, iPadOS, and macOS to a release that includes Apple's fix, per vendor instructions.\nApps that embed WebKit should also be updated to a patched WebKit build.","reach":"internet","impact":"high","summary":"A use-after-free bug in Apple's WebKit engine lets a crafted web page run code when processed by iOS, iPadOS, or macOS. It is listed as actively exploited in the wild.","category":"vendor","who_cares":["apple","ios","ipados","macos","webkit","safari"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the device after a victim opens malicious web content.","analyst_note":"Sources give no fixed version numbers; confirm the patched OS builds in Apple's security releases page for CVE-2021-30858.","how_to_check":"Check the installed OS version under Settings > General > About (iOS/iPadOS) or About This Mac (macOS) and compare it with the patched release in Apple's security notes.","needs_analyst":true,"not_affected_if":["unpatched-devices-not-present"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000499,"input_tokens":2913,"output_tokens":416,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':16A,19A '-30858':17A,20A 'action':122C 'activ':63B 'and':24A 'appl':1A,6A,26B,41B,68C,106C,111C 'apple':21A 'appli':123C 'bug':39B 'cisa':120C 'code':51B,84C 'contain':74C 'content':91C 'could':94C 'craft':47B,89C 'cve':15A,18A 'engin':44B 'execut':85C 'exploit':27B,64B 'free':13A,38B,79C 'html':96C,118C 'impact':95C 'includ':101C 'instruct':127C 'io':2A,7A,28B,55B,69C 'ios':22A 'ipado':3A,8A,29B,56B,70C 'ipados':23A 'lead':82C 'let':45B 'limit':104C 'list':61B 'maco':5A,9A,30B,58B,72C 'macos':25A 'malici':88C 'non':110C 'non-appl':109C 'page':49B 'parser':97C 'per':125C 'process':53B,87C,119C 'product':112C 'reli':114C 'requir':121C 'run':50B 'safari':31B,107C 'updat':124C 'use':11A,36B,77C,99C 'use-after-fre':10A,35B,76C 'vendor':32B,126C 'vulner':14A,80C,93C 'web':48B,90C 'webkit':33B,43B,73C,100C,116C 'wild':67B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-08-24T19:15:14+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-30858","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30858","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:41+00:00","note":null},{"source":"epss","external_id":"CVE-2021-30858","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30858","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-30858","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30858","severity":null,"published_at":"2021-08-24T19:15:14+00:00","modified_at":"2026-06-17T03:51:01+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}