Security readout for executives and security teams
Plain-English summary
A flaw in Apple's web engine could let a booby-trapped website corrupt memory on a Mac, iPhone, or iPad and potentially run attacker code. Apple has already shipped fixes; the risk is mostly to devices that have not been updated. Threat researchers have linked this kind of WebKit bug to a known iOS exploit kit, so out-of-date devices are a real concern.
Executive priority
High priority for any fleet still on older Apple OS or Safari builds. Patch quickly because cited threat-intel ties this class of WebKit flaw to a commercial iOS exploit kit, and a single malicious page could compromise a device.
Technical view
CVE-2023-43000 is a use-after-free (CWE-416) in Apple's WebKit-based web content processing. Visiting a maliciously crafted page can trigger memory corruption that may lead to arbitrary code execution in the renderer. Apple addressed it with improved memory management in macOS Ventura 13.5, iOS/iPadOS 16.6, Safari 16.6, and the legacy iOS/iPadOS 15.8.7 updates. CVSS v3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Likely exposure
Any Apple device running macOS, iOS, iPadOS, or Safari prior to the fixed builds (macOS Ventura 13.5, iOS/iPadOS 16.6, Safari 16.6, iOS/iPadOS 15.8.7). Exposure is highest where users browse untrusted content on unmanaged or out-of-support devices.
Exploitation context
Apple does not flag in-the-wild exploitation in the cited advisories, and CISA KEV does not list this CVE. However, a Google Cloud Threat Intelligence write-up on the "Coruna" iOS exploit kit is referenced, indicating this WebKit bug class has been packaged for targeted device compromise.
Researcher notes
CWE-416 use-after-free in WebKit reachable through crafted web content; CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) is consistent with a one-click drive-by chain. Fixed builds span both the current iOS 16 line and the iOS 15.8.7 legacy update, suggesting Apple back-ported the fix to older hardware. The Mandiant/Google Cloud "Coruna" reference implies attribution to a commercial iOS exploit kit; verify whether your fleet inventory still has unpatched A8/A9-era devices that depend on the 15.8.x branch.
Mitigation direction
- Upgrade to macOS Ventura 13.5 or later, iOS/iPadOS 16.6 or later, or iOS/iPadOS 15.8.7 on legacy hardware.
- Update Safari to 16.6 or later on supported macOS releases.
- Enforce minimum-version policies in MDM and block enrollment of devices that cannot reach a patched build.
- For high-risk users, enable Lockdown Mode to reduce WebKit attack surface until patched.
- Review web filtering and email gateways to block known malicious domains tied to mobile exploit delivery.
- Track Apple security advisory pages 120331, 120338, 120324, and 126632 for any follow-up guidance.
Validation and detection
- Inventory Apple endpoints via MDM and flag any below the fixed builds listed in Apple advisories 120331, 120338, 120324, and 126632.
- Confirm Safari version on macOS hosts is 16.6 or later, including managed and BYOD Macs.
- For legacy iPhones/iPads, verify they are on iOS/iPadOS 15.8.7 if they cannot run iOS 16.
- Cross-check vulnerability scanner results against Apple's CVE-to-build mapping to avoid false negatives.
- Monitor threat intel feeds and the CISA KEV catalog for any future addition of CVE-2023-43000.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-43000 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/120331CVE reference
- https://support.apple.com/en-us/120338CVE reference
- https://support.apple.com/en-us/120324CVE reference
- https://support.apple.com/en-us/126632CVE reference
- https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kitCVE reference · third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.