CVE-2023-42950: Apple Safari RCE Vulnerability

CVE-2023-42950 Overview

CVE-2023-42950 is a use-after-free vulnerability [CWE-416] affecting Apple Safari and the WebKit-based components shipped with multiple Apple operating systems. Processing maliciously crafted web content can trigger memory corruption that leads to arbitrary code execution in the browser process. Apple addressed the flaw through improved memory management in Safari 17.2, iOS 17.2, iPadOS 17.2, tvOS 17.2, watchOS 10.2, and macOS Sonoma 14.2.

The issue is exploitable remotely over the network and requires only that a user visit a malicious or compromised web page. Successful exploitation yields high impact to confidentiality, integrity, and availability of the affected system.

Critical Impact
A drive-by web page can trigger memory corruption in Safari or WebKit-based clients and execute arbitrary code in the context of the rendering process.

Affected Products

Apple Safari prior to 17.2
Apple iOS and iPadOS prior to 17.2
Apple macOS Sonoma prior to 14.2, Apple tvOS prior to 17.2, and Apple watchOS prior to 10.2

Discovery Timeline

2024-03-28 - CVE-2023-42950 published to the National Vulnerability Database
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2023-42950

Vulnerability Analysis

The vulnerability is a use-after-free condition in WebKit, the browser engine that powers Safari and embedded web views across Apple platforms. Use-after-free flaws occur when a program continues to reference memory that has already been freed, allowing an attacker who controls heap layout to redirect execution.

In this case, processing attacker-supplied web content causes the engine to operate on a dangling pointer. An attacker who can shape the freed object and the replacement allocation can corrupt internal state and ultimately achieve arbitrary code execution within the renderer. The flaw is reachable from any drive-by visit to a malicious site, requiring only user interaction in the form of loading the page.

Root Cause

Apple's advisories describe the underlying issue as a use-after-free that was addressed with improved memory management. The condition stems from an object lifetime mismatch in WebKit, where a reference to a freed object remains accessible during subsequent web content processing. The Common Weakness Enumeration entry is [CWE-416] Use After Free.

Attack Vector

The attack vector is network-based and user-interactive. An attacker hosts or injects malicious HTML, JavaScript, or related web content on a page. When a victim opens the page in a vulnerable Safari build or any application embedding the affected WebKit, the engine parses the content, triggers the freed-object reuse, and runs attacker-controlled code in the renderer process. No authentication is required.

No verified public proof-of-concept code is available for this issue. See the Apple Security Update HT214039 advisory for vendor-supplied technical context.

Detection Methods for CVE-2023-42950

Indicators of Compromise

Safari or WebKit-based application crashes correlated with browsing activity, particularly renderer process termination with memory access faults
Outbound connections from browser processes to unfamiliar domains immediately after a page load, suggesting post-exploitation staging
Unexpected child processes spawned from Safari or applications hosting WebKit.framework

Detection Strategies

Inventory endpoints for Safari versions prior to 17.2 and Apple operating systems below the patched releases, and flag any that remain unpatched
Hunt for anomalous process lineage where Safari or WebView-hosting apps spawn shells, scripting interpreters, or download utilities
Correlate browser crash telemetry with subsequent persistence or network activity on the same host

Monitoring Recommendations

Forward macOS and iOS crash reports and EDR telemetry to a central analytics platform for correlation with browsing activity
Monitor web proxy and DNS logs for known malicious domains delivering WebKit exploit chains
Track Apple software update compliance through MDM reporting to identify devices below the patched OS baselines

How to Mitigate CVE-2023-42950

Immediate Actions Required

Update affected devices to Safari 17.2, iOS 17.2, iPadOS 17.2, tvOS 17.2, watchOS 10.2, or macOS Sonoma 14.2 or later
Enforce patch compliance through Mobile Device Management (MDM) policies and block non-compliant devices from sensitive resources
Restrict browsing to trusted sites on devices that cannot be immediately updated

Patch Information

Apple released fixes in Safari 17.2 and the corresponding 17.2 / 14.2 / 10.2 operating system updates. Refer to the vendor advisories: Apple Security Update HT214035, HT214036, HT214039, HT214040, and HT214041. Downstream package updates are tracked in the Fedora Package Announcement and the NetApp Security Advisory NTAP-20241018-0009.

Workarounds

Disable JavaScript in Safari for high-risk browsing sessions where feasible, recognizing that this breaks most modern web functionality
Route web traffic through a filtering proxy that blocks access to known malicious or uncategorized domains
Use an alternate, fully patched browser on unpatched systems until the Apple update can be installed

bash

# Verify Safari version on macOS
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Verify macOS version
sw_vers -productVersion

# Trigger software update check
sudo softwareupdate --install --all --restart