{"id":"CVE-2023-23529","kind":"vulnerability","aliases":["CVE-2023-23529"],"related":[],"title":"A type confusion issue was addressed with improved checks","description":"Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A type confusion bug in Apple's WebKit engine lets a crafted web page run code when it is processed by Safari or another WebKit-based app on iOS, macOS, or iPadOS. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2023-02-14T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"apple safari","fixed":["16.3"],"affected":"< 16.3","ecosystem":"vendor"},{"name":"apple ipados","fixed":["15.7.4"],"affected":"< 15.7.4","ecosystem":"vendor"},{"name":"apple ipados","fixed":["16.3.1"],"affected":">= 16.0, < 16.3.1","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["15.7.4"],"affected":"< 15.7.4","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["16.3.1"],"affected":">= 16.0, < 16.3.1","ecosystem":"vendor"},{"name":"apple macos","fixed":["13.2.1"],"affected":">= 13.0, < 13.2.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ios","ipados","macos","safari","self-hosted","vendor","webkit"],"not_affected_if":["patched-os-version"],"how_to_check":"Check the device OS version in Settings > General > About (iOS/iPadOS) or Apple menu > About This Mac (macOS) and compare against the patched release in Apple's advisory.","fix":"Update iOS, iPadOS, and macOS to a release that includes the Apple fix for CVE-2023-23529, per Apple's security notes; the sources do not name the exact fixed versions.\nFor non-Apple apps that embed WebKit, update to a build that includes the WebKit fix.","status":"open","published_at":"2023-02-14T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:42+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T21:08:42Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS, iPadOS, and macOS to a release that includes the Apple fix for CVE-2023-23529, per Apple's security notes; the sources do not name the exact fixed versions.\nFor non-Apple apps that embed WebKit, update to a build that includes the WebKit fix.","reach":"internet","impact":"high","summary":"A type confusion bug in Apple's WebKit engine lets a crafted web page run code when it is processed by Safari or another WebKit-based app on iOS, macOS, or iPadOS. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["ios","ipados","macos","safari","webkit","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs code on the device after the user loads a malicious web page.","analyst_note":"Find the exact fixed iOS, iPadOS, and macOS versions in Apple's security releases page for CVE-2023-23529, and list affected non-Apple WebKit apps.","how_to_check":"Check the device OS version in Settings > General > About (iOS/iPadOS) or Apple menu > About This Mac (macOS) and compare against the patched release in Apple's advisory.\nunknown","needs_analyst":true,"not_affected_if":["patched-os-version"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000531,"input_tokens":2856,"output_tokens":490,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':11A,14A '-23529':12A,15A 'action':138C 'activ':80B 'address':6A 'anoth':66B 'app':70B 'appl':48B,85C,122C,127C 'apple':16A,19A,21A,23A,25A,28A,31A 'appli':139C 'base':69B 'bug':46B 'check':9A 'cisa':76B,136C 'code':58B,100C 'confus':3A,45B,95C 'contain':92C 'content':107C 'could':110C 'craft':54B,105C 'cve':10A,13A 'engin':51B 'execut':101C 'exploit':33B,81B 'host':40B 'html':112C,134C 'impact':111C 'improv':8A 'includ':117C 'instruct':143C 'io':34B,72B,86C 'ipado':35B,75B,90C 'ipados':22A,24A 'iphone':26A,29A 'issu':4A 'lead':98C 'let':52B 'limit':120C 'list':77B 'maco':36B,73B,87C 'macos':32A 'malici':104C 'multiple':17A 'non':126C 'non-appl':125C 'os':27A,30A 'page':56B 'parser':113C 'per':141C 'process':62B,103C,135C 'product':128C 'products':18A 'reli':130C 'requir':137C 'run':57B 'safari':20A,37B,64B,88C,123C 'self':39B 'self-host':38B 'type':2A,44B,94C 'updat':140C 'use':115C 'vendor':41B,142C 'vulner':96C,109C 'web':55B,106C 'webkit':42B,50B,68B,91C,116C,132C 'webkit-bas':67B 'wild':84B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-02-14T00:00:00+00:00","kev":{"dateAdded":"2023-02-14","dueDate":"2023-03-07","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-23529","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-23529","severity":null,"published_at":"2023-02-14T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:47+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-23529","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23529","severity":null,"published_at":"2023-02-27T20:15:14+00:00","modified_at":"2026-06-17T05:37:21+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}