CVE-2023-23529: Apple Safari RCE Vulnerability

CVE-2023-23529 Overview

CVE-2023-23529 is a type confusion vulnerability in Apple's WebKit browser engine. Processing maliciously crafted web content can trigger arbitrary code execution on affected devices. Apple acknowledged active exploitation at the time of disclosure, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. The issue affects Safari, iOS, iPadOS, and macOS Ventura. Apple addressed the defect with improved type checks in iOS 15.7.4, iPadOS 15.7.4, iOS 16.3.1, iPadOS 16.3.1, macOS Ventura 13.2.1, and Safari 16.3.

Critical Impact

A drive-by attack hosting crafted web content can achieve arbitrary code execution within the WebKit renderer process on unpatched Apple devices.

Affected Products

• Apple Safari (versions prior to 16.3)
• Apple iOS and iPadOS (prior to 15.7.4 and 16.3.1)
• Apple macOS Ventura (prior to 13.2.1)

Discovery Timeline

• 2023-02-27 - CVE-2023-23529 published to NVD
• 2025-10-23 - Last updated in NVD database

Technical Details for CVE-2023-23529

Vulnerability Analysis

The defect is a type confusion flaw [CWE-843] in WebKit, the browser engine that powers Safari and all third-party browsers on iOS and iPadOS. Type confusion occurs when code operates on an object while assuming it has a different type than was actually allocated. In a JavaScript engine, this often arises in the just-in-time (JIT) compiler or in DOM bindings where speculative type assumptions are not revalidated after side effects.

When WebKit interprets memory of one type as another, attackers can read or write outside the intended object layout. This typically yields an arbitrary read/write primitive inside the renderer. Combined with a sandbox escape, the primitive enables full device compromise, which aligns with the active exploitation pattern reported by Apple.

Exploitation requires user interaction in the form of visiting a malicious or compromised page. No authentication is required, and the attack is delivered over the network.

Root Cause

WebKit failed to enforce strict type checks before operating on certain objects. Apple's advisory states the issue was addressed with improved checks, indicating that validation logic was added or hardened in the affected code paths. The CWE-843 classification confirms the underlying weakness is access of a resource using an incompatible type.

Attack Vector

An attacker hosts crafted HTML and JavaScript on an attacker-controlled site or injects it into a compromised site. When a victim loads the page in Safari or any iOS browser using WebKit, the type confusion triggers in the renderer. The attacker gains code execution inside the WebKit content process, typically as a stepping stone toward sandbox escape and broader system compromise.

No verified public proof-of-concept code is available. Technical details remain limited to Apple's advisories and CISA KEV entries.

Detection Methods for CVE-2023-23529

Indicators of Compromise

• Safari or WebKit-based application crashes with EXC_BAD_ACCESS or JavaScriptCore stack frames in crash reports.
• Unexpected child processes or network connections originating from com.apple.WebKit.WebContent or Safari processes.
• Outbound connections to newly registered domains immediately after browser activity on unpatched devices.

Detection Strategies

• Inventory Apple endpoints and flag any running Safari below 16.3, macOS Ventura below 13.2.1, or iOS/iPadOS below 15.7.4 and 16.3.1.
• Correlate browser process crashes with subsequent process spawns or persistence events on the same host.
• Hunt for known exploit delivery infrastructure published in threat intelligence feeds tracking the WebKit zero-day campaign.

Monitoring Recommendations

• Forward macOS unified log entries and crash reports for WebContent processes into a central data lake.
• Monitor mobile device management (MDM) compliance reports for OS version drift on iPhone, iPad, and Mac fleets.
• Alert on anomalous outbound DNS or TLS traffic from browser-spawned processes shortly after page loads.

How to Mitigate CVE-2023-23529

Immediate Actions Required

• Update all Apple devices to iOS 16.3.1, iPadOS 16.3.1, iOS 15.7.4, iPadOS 15.7.4, macOS Ventura 13.2.1, or Safari 16.3 at minimum.
• Prioritize remediation on internet-facing user devices given confirmed in-the-wild exploitation and CISA KEV listing.
• Verify MDM enforcement of minimum OS versions and block enrollment of non-compliant devices from sensitive resources.

Patch Information

Apple released fixes in HT213633, HT213635, HT213638, and HT213673. Tracking is also available in the CISA Known Exploited Vulnerabilities Catalog.

Workarounds

• No vendor-supplied workaround exists; patching is the only supported remediation.
• Restrict browsing on unpatched devices to trusted internal sites via network policy until updates are applied.
• Disable JavaScript in Safari (Settings > Safari > Advanced) on devices that cannot be updated immediately, accepting reduced functionality.

# Verify Safari and macOS versions on a Mac endpoint
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString