{"id":"CVE-2023-28204","kind":"vulnerability","aliases":["CVE-2023-28204"],"related":[],"title":"An out-of-bounds read was addressed with improved input validation","description":"Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.\n\nCISA required action: Apply updates per vendor instructions.","summary":"An out-of-bounds read in WebKit, the browser engine used by Safari and iOS, lets a malicious web page make the browser read memory it should not. An attacker can use it to disclose sensitive information.","severity":"medium","cvss":6.5,"epss":null,"exploited":true,"exploited_at":"2023-05-22T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"apple safari","fixed":["16.5"],"affected":"< 16.5","ecosystem":"vendor"},{"name":"apple ipados","fixed":["15.7.6"],"affected":"< 15.7.6","ecosystem":"vendor"},{"name":"apple ipados","fixed":["16.5"],"affected":">= 16.0, < 16.5","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["15.7.6"],"affected":"< 15.7.6","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["16.5"],"affected":">= 16.0, < 16.5","ecosystem":"vendor"},{"name":"apple macos","fixed":["13.4"],"affected":">= 13.0, < 13.4","ecosystem":"vendor"},{"name":"apple tvos","fixed":["16.5"],"affected":"< 16.5","ecosystem":"vendor"},{"name":"apple watchos","fixed":["9.5"],"affected":"< 9.5","ecosystem":"vendor"},{"name":"webkitgtk webkitgtk\\+","fixed":["2.42.3"],"affected":"< 2.42.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple-devices","exploited","ios","ipados","macos","safari","vendor","webkit"],"not_affected_if":["unknown"],"how_to_check":"Check the OS and Safari versions on each Apple device against Apple's security notes for CVE-2023-28204; unknown which exact builds are fixed in the sources.","fix":"Update iOS, iPadOS, macOS, tvOS, watchOS and Safari to the latest versions per Apple's vendor instructions.\nFor non-Apple apps embedding WebKit, unknown which versions are fixed.","status":"open","published_at":"2023-05-22T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:06:42+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:06:42Z","model":"claude-haiku-5-5","output":{"fix":"Update iOS, iPadOS, macOS, tvOS, watchOS and Safari to the latest versions per Apple's vendor instructions.\nFor non-Apple apps embedding WebKit, unknown which versions are fixed.","reach":"internet","impact":"low","summary":"An out-of-bounds read in WebKit, the browser engine used by Safari and iOS, lets a malicious web page make the browser read memory it should not. An attacker can use it to disclose sensitive information.","category":"vendor","who_cares":["ios","ipados","macos","safari","webkit","apple-devices"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads sensitive memory via a crafted web page","analyst_note":"Confirm fixed Apple build numbers and the list of affected non-Apple WebKit embedders from Apple's security releases and the CISA KEV entry.","how_to_check":"Check the OS and Safari versions on each Apple device against Apple's security notes for CVE-2023-28204; unknown which exact builds are fixed in the sources.","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000503,"input_tokens":2878,"output_tokens":431,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':14A,17A '-28204':15A,18A 'action':148C 'address':8A 'appl':43B,90C,132C,137C 'apple':19A,22A,24A,26A,28A,31A,34A,36A,38A 'apple-devic':42B 'appli':149C 'attack':82B 'bound':5A,56B,104C 'browser':61B,75B 'cisa':146C 'contain':99C 'content':117C 'could':120C 'craft':115C 'cve':13A,16A 'devic':44B 'disclos':87B,109C 'engin':62B 'exploit':45B 'html':122C,144C 'impact':121C 'improv':10A 'includ':127C 'inform':89B,111C 'input':11A 'instruct':153C 'io':46B,67B,91C 'ipado':47B,92C 'ipados':25A,27A 'iphone':29A,32A 'let':68B 'limit':130C 'maco':48B,93C 'macos':35A 'make':73B 'malici':70B,114C 'may':108C 'memori':77B 'multiple':20A 'non':136C 'non-appl':135C 'os':30A,33A 'out-of-bound':2A,53B,101C 'page':72B 'parser':123C 'per':151C 'process':113C,145C 'product':138C 'products':21A 'read':6A,57B,76B,105C 'reli':140C 'requir':147C 'safari':23A,49B,65B,97C,133C 'sensit':88B,110C 'tvos':37A,94C 'updat':150C 'use':63B,84B,125C 'valid':12A 'vendor':50B,152C 'vulner':106C,119C 'watcho':95C 'watchos':39A 'web':71B,116C 'webkit':51B,59B,98C,126C,142C 'webkitgtk':40A,41A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-05-22T00:00:00+00:00","kev":{"dateAdded":"2023-05-22","dueDate":"2023-06-12","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-28204","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-28204","severity":null,"published_at":"2023-05-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:47+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-28204","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28204","severity":null,"published_at":"2023-06-23T18:15:11+00:00","modified_at":"2026-06-17T05:47:05+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}