{"id":"CVE-2022-22620","kind":"vulnerability","aliases":["CVE-2022-22620"],"related":[],"title":"Apple iOS, iPadOS, and macOS: Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability","description":"Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Apple's WebKit browser engine, used by iOS, iPadOS, macOS and Safari, has a use-after-free bug in how it parses HTML. A malicious web page can make it run code on the device.","severity":"high","cvss":8.8,"epss":0.16342,"exploited":true,"exploited_at":"2022-02-11T00:00:00+00:00","products":[{"name":"Apple iOS, iPadOS, and macOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ios","ipados","macos","safari","vendor","webkit"],"not_affected_if":["fully-patched-devices"],"how_to_check":null,"fix":"Update iOS, iPadOS and macOS to a release that includes Apple's fix; CISA says apply updates per vendor instructions. Specific fixed versions are unknown from the sources.","status":"open","published_at":"2022-02-11T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:38+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:26:38Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS, iPadOS and macOS to a release that includes Apple's fix; CISA says apply updates per vendor instructions. Specific fixed versions are unknown from the sources.","reach":"internet","impact":"high","summary":"Apple's WebKit browser engine, used by iOS, iPadOS, macOS and Safari, has a use-after-free bug in how it parses HTML. A malicious web page can make it run code on the device.","category":"vendor","who_cares":["ios","ipados","macos","safari","webkit"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code on the device after the user loads a malicious web page.","analyst_note":"Find Apple's security advisory for CVE-2022-22620 to get the fixed OS versions and check the KEV due date; the sources do not list them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fully-patched-devices"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000473,"input_tokens":2918,"output_tokens":362,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':18A,21A '-22620':19A,22A 'action':125C 'and':26A 'appl':1A,6A,35B,71C,109C,114C 'apple':23A 'appli':126C 'browser':38B 'bug':53B 'cisa':123C 'code':67B,87C 'contain':77C 'content':94C 'could':97C 'craft':92C 'cve':17A,20A 'devic':70B 'engin':39B 'execut':88C 'exploit':28B 'free':15A,52B,82C 'html':58B,99C,121C 'impact':98C 'includ':104C 'instruct':130C 'io':2A,7A,29B,42B,72C 'ios':24A 'ipado':3A,8A,30B,43B,73C 'ipados':25A 'lead':85C 'limit':107C 'maco':5A,10A,31B,44B,75C 'macos':27A 'make':64B 'malici':60B,91C 'non':113C 'non-appl':112C 'page':62B 'pars':57B 'parser':100C 'per':128C 'process':90C,122C 'product':115C 'reli':117C 'requir':124C 'run':66B 'safari':32B,46B,110C 'updat':127C 'use':13A,40B,50B,80C,102C 'use-after-fre':12A,49B,79C 'vendor':33B,129C 'vulner':16A,83C,96C 'web':61B,93C 'webkit':11A,34B,37B,76C,103C,119C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-02-11T00:00:00+00:00","kev":{"dateAdded":"2022-02-11","dueDate":"2022-02-25","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-22620","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-22620","severity":null,"published_at":"2022-02-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:37+00:00","note":null},{"source":"epss","external_id":"CVE-2022-22620","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22620","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-22620","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22620","severity":null,"published_at":"2022-03-18T18:15:13+00:00","modified_at":"2026-06-17T04:28:41+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}