CVE-2023-28201: Apple Safari RCE Vulnerability

CVE-2023-28201 is a remote code execution vulnerability in Apple Safari caused by improper state management. Attackers can exploit this flaw to execute arbitrary code or crash applications remotely. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2023-28201 Overview

CVE-2023-28201 is a state management flaw affecting multiple Apple operating systems and Safari. A remote attacker can trigger unexpected application termination or arbitrary code execution by exploiting improper handling of internal state. Apple addressed the issue with improved state management across macOS, iOS, iPadOS, tvOS, and Safari. The weakness is associated with [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization), indicating a race condition pattern. The vulnerability was published to the National Vulnerability Database (NVD) on May 8, 2023.

Critical Impact
A remote user may be able to cause unexpected app termination or arbitrary code execution on unpatched Apple devices reachable over the network.

Affected Products

Apple Safari (prior to 16.4)
Apple iOS and iPadOS (prior to 16.4, and 15.7.4 branch)
Apple macOS Ventura (prior to 13.3) and Apple tvOS (prior to 16.4)

Discovery Timeline

2023-05-08 - CVE-2023-28201 published to NVD
2025-01-29 - Last updated in NVD database

Technical Details for CVE-2023-28201

Vulnerability Analysis

The vulnerability stems from improper state management in components shared across Apple's Safari browser and operating system platforms. According to Apple's advisories, the flaw allows a remote user to cause unexpected application termination or to execute arbitrary code. The Common Weakness Enumeration mapping ([CWE-362]) indicates that concurrent execution paths can manipulate shared state without proper synchronization. Successful exploitation does not require authentication or user interaction over the network, which broadens the attack surface for drive-by content delivery. The Exploit Prediction Scoring System (EPSS) reports a probability of 1.876% at the 83.333 percentile, indicating elevated relative likelihood of exploitation activity compared to most published CVEs.

Root Cause

Apple's release notes describe the fix as "improved state management," which is consistent with a race condition or inconsistent state transition in code shared by Safari/WebKit components and supporting OS frameworks. The defect allows a remote actor to drive the affected component into an unintended state, corrupting memory or control flow.

Attack Vector

The attack vector is network-based. An attacker hosting crafted web content can trigger the flaw when a victim visits a malicious or compromised page using a vulnerable Safari build, or when an OS component processes affected remote content. Successful exploitation can crash the process or run attacker-controlled code in the context of the affected application.

No verified proof-of-concept is publicly available. Refer to the Apple Security Update HT213670, HT213671, HT213673, HT213674, and HT213676 for vendor-confirmed details.

Detection Methods for CVE-2023-28201

Indicators of Compromise

Repeated Safari, WebKit, or related system process crashes (com.apple.WebKit.WebContent, Safari) recorded in macOS or iOS diagnostic logs.
Outbound connections from browser processes to newly registered or low-reputation domains immediately preceding a crash.
Unsigned or unexpected child processes spawned by Safari or WebKit hosts on macOS endpoints.

Detection Strategies

Inventory Apple endpoints and flag any device running Safari below 16.4, macOS Ventura below 13.3, iOS/iPadOS below 16.4 (or 15.7.4 on the legacy branch), or tvOS below 16.4.
Alert on WebKit content process crashes correlated with browsing activity, prioritizing repeated failures from the same origin.
Hunt for post-exploitation behaviors such as keychain access, AppleScript abuse, or persistence via LaunchAgents originating from browser-spawned processes.

Monitoring Recommendations

Forward macOS Unified Logs and iOS device management telemetry to a centralized SIEM for correlation with web proxy logs.
Monitor MDM compliance reports for OS and Safari version drift and enforce automatic update policies.
Track DNS and TLS SNI telemetry for browser sessions that immediately precede process crashes.

How to Mitigate CVE-2023-28201

Immediate Actions Required

Update all Apple endpoints to macOS Ventura 13.3, Safari 16.4, iOS/iPadOS 16.4, iOS/iPadOS 15.7.4, or tvOS 16.4 or later.
Use Mobile Device Management (MDM) to enforce minimum OS and browser versions and restrict noncompliant devices from sensitive resources.
Audit browser extensions and remove unsigned or unnecessary content handlers that increase the attack surface.

Patch Information

Apple shipped fixes in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, and tvOS 16.4. Vendor advisories are available at HT213670, HT213671, HT213673, HT213674, and HT213676.

Workarounds

Where patching is delayed, restrict Safari usage to trusted sites via web filtering and block high-risk content categories at the proxy.
Disable JavaScript on legacy or unmanaged devices that cannot be promptly updated, accepting the usability tradeoff.
Segment unpatched tvOS and legacy iOS devices onto isolated network VLANs with restricted egress.

bash

# Verify installed versions on macOS before allowing network access
sw_vers -productVersion
/usr/bin/defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString