Critical WebKit Zero‑Day (CVE‑2023‑23529) Fixed in Apple’s Latest Security Update

Apple Issues Security Updates for iOS, iPadOS, and macOS to Patch Critical WebKit Zero‑Day (CVE‑2023‑23529)

The Hacker News reported that Apple recently rolled out security updates for iOS, iPadOS, and macOS to address a zero‑day vulnerability tracked as CVE‑2023‑23529.

Research shows CVE‑2023‑23529 is a type‑confusion bug in the open‑source WebKit browser engine; successful exploitation enables an attacker to execute arbitrary code on the target system.

WebKit powers Safari, Dashboard, Mail, and many other macOS applications and is widely used on mobile platforms such as iPhone and iPad.

Domestic Security Vendor Detects Multiple Apple Vulnerabilities

In addition to CVE‑2023‑23529, a domestic security firm has observed several other Apple‑issued security advisories, including:

Apple Kernel privilege‑escalation vulnerability (CVE‑2023‑23514) Apple macOS Ventura sensitive‑information leak (CVE‑2023‑23522)

Compared with the other two, CVE‑2023‑23529 has the widest impact and highest severity. It allows an unauthenticated remote attacker to lure a victim to a crafted malicious website, trigger a type‑confusion error in WebKit, and achieve arbitrary code execution.

Affected Apple Products

iPhone 8 and later All iPad Pro models iPad Air 3rd generation and later iPad 5th generation and later iPad mini 5th generation and later Macs running macOS Ventura

Attackers can combine CVE‑2023‑23529 with CVE‑2023‑23514 to gain higher privileges and escape the Safari sandbox. Security researchers have observed signs of wild exploitation of CVE‑2023‑23529, so customers are advised to perform self‑checks and apply mitigations promptly.

Apple Releases Security Update

On February 14, Apple officially released the iOS 16.3.1 security update, which patches the high‑severity CVE‑2023‑23529. Users are strongly encouraged to upgrade immediately.

The update log confirms that the fix targets the vulnerability in WebKit. WebKit security issues have persisted for a long time; in 2022 Apple patched ten zero‑days, four of which were in WebKit.

References

https://thehackernews.com/2023/02/patch-now-apples-ios-ipados-macos-and.html https://securityaffairs.com/142200/hacking/apple-zero-day-iphones-macs.html https://www.sohu.com/a/640613206_120914897 https://www.secrss.com/articles/51867