8.8
CVSSv3

CVE-2022-22620

Published: 18/03/2022 Updated: 26/03/2022
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

A use after free vulnerability was found in WebKitGTK allowing an malicious user to perform remote code execution using maliciously crafted web content.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apple safari

apple ipados

apple iphone os

apple macos

Vendor Advisories

A use after free vulnerability was found in WebKitGTK allowing an attacker to perform remote code execution using maliciously crafted web content ...
The following vulnerabilities have been discovered in the WebKitGTK web engine: CVE-2022-22589 Heige and Bo Qu discovered that processing a maliciously crafted mail message may lead to running arbitrary javascript CVE-2022-22590 Toan Pham discovered that processing maliciously crafted web content may lead to arbitrary code executi ...
The following vulnerabilities have been discovered in the WPE WebKit web engine: CVE-2022-22589 Heige and Bo Qu discovered that processing a maliciously crafted mail message may lead to running arbitrary javascript CVE-2022-22590 Toan Pham discovered that processing maliciously crafted web content may lead to arbitrary code execut ...

Mailing Lists

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-02-10-3 Safari 153 Safari 153 addresses the following issues Information about the security content is alsoavailable at supportapplecom/HT213091 WebKit Available for: macOS Big Sur and macOS Catalina Impact: Processing maliciously crafted web content may lead to arbitrar ...
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-02-10-1 iOS 1531 and iPadOS 1531 iOS 1531 and iPadOS 1531 addresses the following issues Information about the security content is also available at supportapplecom/HT213093 WebKit Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPa ...
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-02-10-2 macOS Monterey 1221 macOS Monterey 1221 addresses the following issues Information about the security content is also available at supportapplecom/HT213092 WebKit Available for: macOS Monterey Impact: Processing maliciously crafted web content may lead to arbit ...
------------------------------------------------------------------------ WebKitGTK and WPE WebKit Security Advisory WSA-2022-0003 ------------------------------------------------------------------------ Date reported : February 17, 2022 Advisory ID : WSA-2022-0003 WebKitGTK Advisory URL : webkitgtkor ...

Github Repositories

CVE-2022-22620 CVE-2022-22620: Use-after-free in Safari

Recent Articles

Apple emergency update fixes zero-day used to hack Macs, Watches
BleepingComputer • Sergiu Gatlan • 16 May 2022

Apple has released security updates to address a zero-day vulnerability that threat actors can exploit in attacks targeting Macs and Apple Watch devices.
Zero-days are security flaws that the software vendor is unaware of and hasn't yet patched. In some cases, this type of vulnerability may also have publicly available proof-of-concept exploits before a patch arrives or may be actively exploited in the wild.
In

issued on Monday, Apple revealed that they're aware of re...

Apple Patches Actively Exploited WebKit Zero Day
Threatpost • Elizabeth Montalbano • 11 Feb 2022

Apple has patched yet another zero-day vulnerability, this time in its WebKit browser engine, that threat actors already are actively exploiting to compromise iPhones, iPads and MacOS devices.
The zero-day, tracked as CVE-2022-22620, is a Use-After-Free issue, which is related to incorrect use of dynamic memory during program operation.
In the case of Apple’s zero-day, threat actors can execute arbitrary code on affected devices after they process maliciously crafted web content, t...

CISA orders federal agencies to update iPhones, Macs until Feb 25th
BleepingComputer • Sergiu Gatlan • 11 Feb 2022

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a new flaw to its catalog of vulnerabilities exploited in the wild, an Apple WebKit remote code execution bug used to target iPhones, iPads, and Macs.
According to the 
 issued by CISA in November, federal agencies are now required to patch their systems against this actively exploited vulnerability impacting iOS, iPadOS, and macOS devices.
CISA said that all Federal Civilian Executive ...

CISA orders federal agencies to update iPhones until Feb 25th
BleepingComputer • Sergiu Gatlan • 11 Feb 2022

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a new flaw to its catalog of vulnerabilities exploited in the wild, an Apple WebKit bug used to target iPhones, iPads, and Macs.
According to the 
 issued by CISA in November, federal agencies are now required to patch their systems against this actively exploited vulnerability impacting iOS, iPadOS, and macOS devices.
CISA said that all Federal Civilian Executive Branch Agencies (FCEB)...

How refactoring code in Safari's WebKit resurrected 'zombie' security bug
The Register • Jeff Burt • 01 Jan 1970

Topics Security Off-Prem On-Prem Software Offbeat Vendor Voice Vendor Voice Resources Fixed in 2013, reinstated in 2016, exploited in the wild this year

A security flaw in Apple's Safari web browser that was patched nine years ago was exploited in the wild again some months ago – a perfect example of a "zombie" vulnerability.
That's a bug that's been patched, but for whatever reason can be abused all over again on up-to-date systems and devices – or a bug closely related to a patched one.
In a write-up this month, Maddie Stone, a top researcher on Google's Project Zero team, shared details of a Safari vulnerability that folks rea...

Apple emits emergency fix for exploited-in-the-wild WebKit vulnerability
The Register • Thomas Claburn in San Francisco • 01 Jan 1970

Get our weekly newsletter Flaw imperils Safari – and every iOS browser because of Cupertino's T&Cs

Apple on Thursday patched a zero-day security vulnerability in its WebKit browser engine, issuing updates for iOS, iPadOS, and macOS.
Its Safari browser, based on WebKit, received the security update separately for instances where it is being used with an older version of macOS, like Big Sur. Apple's tvOS was also refreshed, but without the security fix.
The updates – iOS 15.3.1, iPadOS 15.3.1, and macOS Monterey 12.2.1 – address CVE-2022-22620, reported to Apple by an anonymous ...

Apple patches new zero-day exploited to hack iPhones, iPads, Macs
BleepingComputer • Sergiu Gatlan • 01 Jan 1970

Apple has released security updates to fix a new zero-day vulnerability exploited in the wild by attackers to hack iPhones, iPads, and Macs.
The zero-day patched today is tracked as CVE-2022-22620 [
,
] and is a WebKit
issue that could lead to OS crashes and code execution on compromised devices.
Successful exploitation of this bug allows attackers to execute arbitrary code on iPhones and iPads running vulnerable versions of iOS and iPadOS after processing malici...