---
id: "CVE-2022-22620"
kind: "vulnerability"
aliases: ["CVE-2022-22620"]
title: "Apple iOS, iPadOS, and macOS: Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability"
severity: "high"
cvss: 8.8
epss: 0.16342
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Apple iOS, iPadOS, and macOS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ios", "ipados", "macos", "safari", "vendor", "webkit"]
not_affected_if: ["fully-patched-devices"]
published_at: "2022-02-11T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-22620", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22620", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22620", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apple iOS, iPadOS, and macOS: Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability

Apple's WebKit browser engine, used by iOS, iPadOS, macOS and Safari, has a use-after-free bug in how it parses HTML. A malicious web page can make it run code on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apple iOS, iPadOS, and macOS affected ? fixed ?

## Fix

Update iOS, iPadOS and macOS to a release that includes Apple's fix; CISA says apply updates per vendor instructions. Specific fixed versions are unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-22620
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-22620
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-22620

## From the sources

Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_