Pierluigi Paganini February 11, 2022

Apple addressed a new WebKit zero-day affecting iOS, iPadOS, macOS, and Safari that may have been actively exploited in the wild.

Apple has addressed a zero-day vulnerability, tracked as CVE-2022-22620, in the WebKit affecting iOS, iPadOS, macOS, and Safari that may have been actively exploited in the wild.

This is the third zero-day vulnerability fixed by the IT giant this year.

The flaw is a use after free issue that could be triggered by processing maliciously crafted web content, leading to arbitrary code execution

“Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.” reads the security advisory published by Apple. “A use after free issue was addressed with improved memory management.”

The vulnerability was reported by an anonymous researcher, the company addressed it by improving the memory management.

Apple released security updates for iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation), macOS devices running Big Sur and macOS Catalina, and also as a standalone update for Safari.

Recently the company has addressed another couple of zero-day vulnerabilities tracked as CVE-2022-22587 and CVE-2022-22594 respectively. An attacker could have exploited the flaws to run arbitrary code on the vulnerable devices and track users’ online activity in the web browser.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, zero-day)

[adrotate banner=”5″]

[adrotate banner=”13″]