How to Fix CVE-2021-1789: Remote Code Execution in iOS and iPadOS, macOS

Patch immediately. This is a WebKit type-confusion bug that lets a booby-trapped web page run arbitrary code on an unpatched Apple device. CISA listed it in the Known Exploited Vulnerabilities catalog on 2022-05-04 with a federal remediation deadline of 2022-05-25. The fix is a free operating-system or browser update: update to iOS / iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 on Catalina or Mojave, tvOS 14.4, watchOS 7.3, or Safari 14.0.3.

What is CVE-2021-1789?

CVE-2021-1789 is a type confusion vulnerability (CWE-843) in WebKit, the browser engine that powers Safari and every web view across Apple's platforms. Apple's own advisory text is precise: "A type confusion issue was addressed with improved state handling… Processing maliciously crafted web content may lead to arbitrary code execution." In plain terms, the engine treats a chunk of memory as one object type when it is actually another, and that mismatch hands an attacker a primitive they can chain into full code execution.

Because the trigger is web content, exploitation does not need credentials, an open port, or a network service. The victim simply has to load a malicious or compromised page in Safari, in an in-app web view, or in any app that renders HTML through WebKit. That is exactly what the CVSS vector reflects: AV:N/AC:L/PR:N/UI:R — network reachable, low complexity, no privileges required, but one click (user interaction) needed. With high confidentiality, integrity, and availability impact, the base score lands at 8.8 (High).

This was patched as part of a coordinated WebKit fix that shipped across the whole Apple fleet at once: iOS and iPadOS 14.4, macOS Big Sur 11.2, the 2021-001 security updates for the older Catalina and Mojave lines, tvOS 14.4, watchOS 7.3, and Safari 14.0.3 (for the supported macOS lines that get Safari separately). The same WebKit code also feeds the open-source WebKitGTK package, which is why this CVE picked up downstream Fedora and Gentoo advisories.

Why this matters

A WebKit RCE is the front half of a classic exploit chain. On its own it runs code inside the sandboxed renderer process, but type-confusion primitives like this one are routinely paired with a kernel or sandbox-escape bug to reach full device compromise — the pattern used by commercial spyware and one-click attacks against iPhones and Macs. CISA's decision to add it to the KEV catalog on 2022-05-04 means at least one confirmed in-the-wild exploitation report exists, and its SSVC record explicitly marks exploitation as "active."

The blast radius is every browsing surface on the device: Safari tabs, links opened from Mail or Messages, and any third-party app that renders untrusted HTML through the system web view. There is no firewall rule that fully closes this; the only durable fix is the OS or Safari update.

Am I affected?

Check the OS or Safari version on each device against the Fixed in row. You are vulnerable if any of the following is true:

• iPhone or iPad running iOS / iPadOS earlier than 14.4.
• Mac on Big Sur earlier than 11.2, or on Catalina / Mojave that has not received Security Update 2021-001.
• Apple TV on tvOS earlier than 14.4, or Apple Watch on watchOS earlier than 7.3.
• A supported Mac whose Safari is older than 14.0.3.

On iPhone or iPad, open Settings → General → About and read the Software Version. On a Mac, choose Apple menu → About This Mac; for Safari, open Safari → About Safari.

How to fix CVE-2021-1789

There is no package to recompile and no service to restart — the remediation is the vendor software update for each platform. Apply the relevant one below.

iPhone and iPad (iOS / iPadOS 14.4)

1. Back the device up to iCloud or a Mac first.
2. Open Settings → General → Software Update.
3. Install iOS / iPadOS 14.4 or any later release; later releases roll this fix forward.
4. For a managed fleet, push the minimum-OS rule through your MDM (Jamf, Intune, or Apple Business Manager) so devices below 14.4 are flagged or forced to update.

Mac (macOS Big Sur 11.2 or Security Update 2021-001)

1. Open Apple menu → System Preferences → Software Update.
2. On Big Sur, install the macOS 11.2 update. On Catalina or Mojave, install Security Update 2021-001 (this delivers the WebKit fix without a major-version upgrade).
3. If you manage Safari separately on a supported line, confirm it reaches 14.0.3 — it ships inside the same update.

Apple TV and Apple Watch

1. Apple TV: Settings → System → Software Updates → install tvOS 14.4 or later.
2. Apple Watch: in the iPhone Watch app, General → Software Update → install watchOS 7.3 or later (keep the watch on its charger).

Linux desktops shipping WebKitGTK

If you run a Linux desktop that pulls WebKit through WebKitGTK, the downstream advisories cover the same engine. Update the WebKitGTK package from your distribution:

# Fedora (per advisory FEDORA-2021-864dc37032 / FEDORA-2021-619711d709)
sudo dnf upgrade --refresh webkit2gtk3

# Gentoo (per GLSA 202104-03)
sudo emerge --sync && sudo emerge --ask --oneshot --verbose net-libs/webkit-gtk

If you can't patch immediately

There is no Apple-published configuration workaround for this WebKit flaw — the advisory ships only the update. Until you can install it, reduce exposure:

• Avoid untrusted links and pages on the affected device, especially from email, messages, or unfamiliar sites, since a single page load is the trigger.
• Lock Down Mode is not available on these older releases, so the practical interim control is to keep high-risk browsing off the unpatched device entirely.
• Prioritise shared and kiosk devices that browse arbitrary content; they are the highest-value targets.

How to verify the fix worked

1. Confirm the version: Settings → General → About on iOS/iPadOS shows 14.4 or later; About This Mac shows 11.2 (or the 2021-001 update on Catalina/Mojave); About Safari shows 14.0.3 or later.
2. On a managed fleet, run a compliance report in your MDM filtered to devices below the fixed build and confirm the count reaches zero.
3. Re-scan with your vulnerability scanner (Nessus, Qualys, Tenable). CVE-2021-1789 should no longer flag on the updated device.

Frequently asked questions

Is CVE-2021-1789 actually a remote code execution bug?

Yes, but the precise root cause is a type confusion flaw (CWE-843) in WebKit. Processing maliciously crafted web content lets that type confusion be driven to arbitrary code execution, so it is correctly classed as RCE with a CVSS 8.8 base score.

What version do I update to?

iOS / iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 on Catalina or Mojave, tvOS 14.4, watchOS 7.3, or Safari 14.0.3 — whichever applies to the device. Any later release also contains the fix.

Is it being exploited in the wild?

Yes. CISA added CVE-2021-1789 to the Known Exploited Vulnerabilities catalog on 2022-05-04 and its SSVC assessment marks exploitation as active, with a federal remediation deadline of 2022-05-25.

I run Linux, not a Mac — why does this CVE mention my distro?

WebKit's source is shared with the open-source WebKitGTK library used by some Linux desktop apps. Fedora (FEDORA-2021-864dc37032, FEDORA-2021-619711d709) and Gentoo (GLSA 202104-03) issued advisories to ship the same fix in their webkit2gtk3 / webkit-gtk packages.

References

• Apple security advisories (per product): HT212147, HT212146, HT212148, HT212149, HT212152
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-1789
• CISA KEV catalog: CVE-2021-1789 in KEV — "Apple Multiple Products Type Confusion Vulnerability", added 2022-05-04
• Downstream WebKitGTK advisories: GLSA-202104-03 (Gentoo); Fedora FEDORA-2021-864dc37032 / FEDORA-2021-619711d709

Assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Nearby vulnerabilities you may as well remediate alongside this fix:

• How to Fix CVE-2021-1879: Denial of Service in iOS, iOS and iPadOS, watchOS
• How to Fix CVE-2021-30883: Denial of Service in iOS and iPadOS, macOS
• How to Fix CVE-2021-1782: Race Condition in iOS and iPadOS, macOS
• How to Fix CVE-2021-30869: Type Confusion in iOS and iPadOS, macOS
• How to Fix CVE-2021-30665: Remote Code Execution in macOS