---
id: "CVE-2021-30858"
kind: "vulnerability"
aliases: ["CVE-2021-30858"]
title: "Apple iOS, iPadOS, and macOS: Apple iOS, iPadOS, macOS Use-After-Free Vulnerability"
severity: "critical"
cvss: 8.8
epss: 0.13379
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Apple iOS, iPadOS, and macOS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apple", "exploited", "ios", "ipados", "macos", "safari", "vendor", "webkit"]
not_affected_if: ["unpatched-devices-not-present"]
published_at: "2021-08-24T19:15:14+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30858", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-30858", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30858", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apple iOS, iPadOS, and macOS: Apple iOS, iPadOS, macOS Use-After-Free Vulnerability

A use-after-free bug in Apple's WebKit engine lets a crafted web page run code when processed by iOS, iPadOS, or macOS. It is listed as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple iOS, iPadOS, and macOS affected ? fixed ?

## How to check

Check the installed OS version under Settings > General > About (iOS/iPadOS) or About This Mac (macOS) and compare it with the patched release in Apple's security notes.

## Fix

Update iOS, iPadOS, and macOS to a release that includes Apple's fix, per vendor instructions.
Apps that embed WebKit should also be updated to a patched WebKit build.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30858
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-30858
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-30858

## From the sources

Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_