HowToFixMe
● High · CVSS 8.8 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2023-23529: Remote Code Execution in Safari, iOS and iPadOS, macOS

⚡ At a glance
SeverityCVSS 8.8 - High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Actively exploited?Yes - Apple confirms a report of active exploitation; in CISA KEV (added 2023-02-14)
Affected componentWebKit, in iOS/iPadOS, Safari and macOS
AffectediOS/iPadOS before 16.3.1 and before 15.7.4; macOS Ventura before 13.2.1; Safari before 16.3
Fixed iniOS/iPadOS 16.3.1; iOS/iPadOS 15.7.4 (older devices); macOS Ventura 13.2.1; Safari 16.3
Type (CWE)CWE-843 Type confusion → arbitrary code execution (RCE)

Exploitation status

CVE-2023-23529 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on as “Apple Multiple Products WebKit Type Confusion Vulnerability”, which makes patching mandatory for U.S. federal agencies under Binding Operational Directive 22-01. Federal agencies were required to remediate it by . If you run an affected system, treat this as an emergency change, not a scheduled one.

Public exploit availability: although a public exploit is not directly linked in this CVE’s primary references, its place on the CISA KEV catalog confirms working attack code is in active use in the wild, treat weaponization as certain and patch on an emergency timeline.

Authoritative references:

Update now. This is a WebKit type confusion bug Apple confirms was reported as actively exploited, so it falls squarely in the zero-day category. Install the relevant patched build below on every iPhone, iPad, and Mac you manage, and push the Safari 16.3 update to any older Mac that cannot run Ventura.

What is CVE-2023-23529?

CVE-2023-23529 is a type confusion vulnerability (CWE-843) in WebKit, the browser engine that powers Safari and every web view on iOS, iPadOS, and macOS. In Apple's own words: “A type confusion issue was addressed with improved checks … Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.”

Type confusion means the engine accesses a block of memory while treating it as the wrong object type. WebKit allocates an object as one type, then a different code path interprets the same memory as an incompatible type. That mismatch lets an attacker manipulate memory in ways the engine never validated, corrupting pointers and ultimately steering execution into attacker-controlled code. Because the trigger is simply rendering a web page, this is a classic drive-by remote code execution primitive: open the wrong page, and code runs in the WebKit content process with no click beyond the visit itself.

It is not a server-side or network-service flaw. There is nothing to firewall off and no daemon to restart. The vulnerable code ships inside the operating system and inside Safari, so the only real remediation is installing the Apple build that contains the corrected checks.

Why this matters

The CVSS 3.1 base score is 8.8 (High), vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Network attack vector, low complexity, no privileges required, and high impact to confidentiality, integrity, and availability. The single barrier is user interaction (UI:R) - the victim has to load the malicious content. For a consumer-facing web bug that bar is trivially cleared with a phishing link, a malicious ad, or a compromised site.

Apple disclosed the issue on 2023-02-27 and explicitly noted a report of active exploitation. CISA added CVE-2023-23529 to the Known Exploited Vulnerabilities catalog on 2023-02-14 under the title “Apple Multiple Products WebKit Type Confusion Vulnerability”, with a federal remediation deadline of 2023-03-07 under Binding Operational Directive 22-01. WebKit zero-days like this one are frequently chained with a kernel privilege-escalation bug to break out of the browser sandbox and achieve full device compromise, which is the typical pattern behind mobile spyware implants.

Am I affected?

You are exposed if any of the following are below their patched build:

Check the running version before you assume you are clear. On iPhone or iPad, open Settings → General → About and read the Software Version. On a Mac, choose Apple menu → About This Mac for the macOS version and Safari → About Safari for the browser build.

How to fix CVE-2023-23529

There is no command-line patch and no configuration toggle. The fix is the vendor update for your platform. Pick the path that matches your device.

iPhone and iPad

  1. Open Settings → General → Software Update.
  2. Install iOS / iPadOS 16.3.1 on supported devices, or iOS / iPadOS 15.7.4 on devices that remain on iOS 15. Either build (or anything later) contains the fix.
  3. Keep the device on power and Wi-Fi until it finishes installing and reboots.

Mac

  1. If you run macOS Ventura, open Apple menu → System Settings → General → Software Update and install macOS Ventura 13.2.1 or later. This updates both the OS WebKit and Safari together.
  2. If you run macOS Big Sur or Monterey, the OS-level fix is delivered as Safari 16.3. Open Software Update and install the Safari update; on those systems Safari ships independently of the full OS bump.

Managed fleets (MDM)

If you run Jamf, Intune, Kandji, or another MDM, mark the affected builds as the minimum required OS and let your update-enforcement policy push them. For supervised iOS/iPadOS devices you can issue the ScheduleOSUpdate MDM command to force installation rather than waiting on the user. The target builds remain iOS/iPadOS 16.3.1, iOS/iPadOS 15.7.4, macOS Ventura 13.2.1, and Safari 16.3.

Verify the fix landed

After the reboot, confirm the build:

On a tethered iOS device you can also read the build programmatically with libimobiledevice:

# Read the running iOS/iPadOS version over USB
ideviceinfo -k ProductVersion   # expect 16.3.1+ or 15.7.4+
ideviceinfo -k BuildVersion

If you can't update immediately

Apple shipped no separate workaround for CVE-2023-23529 - the patched build is the remediation. Until the update is installed, reduce the chance of triggering the bug:

If you suspect compromise

Because Apple confirmed active exploitation, treat any device that was used to browse heavily and stayed unpatched past the disclosure as potentially targeted. There is no reliable on-device scanner for this class of implant. For a high-risk individual, back up data, then perform a full erase and restore to a clean, fully patched build rather than trusting an in-place update, and rotate credentials that were entered on the device. If you manage iPhones for at-risk users, consider enrolling them in Apple's targeted-threat protections and keeping Lockdown Mode on permanently.

Frequently asked questions

Which exact versions fix CVE-2023-23529?

Apple fixed it in iOS 16.3.1 and iPadOS 16.3.1, iOS 15.7.4 and iPadOS 15.7.4 for older devices, macOS Ventura 13.2.1, and Safari 16.3. Any of these builds or later on the matching platform closes the flaw.

I am on macOS Big Sur or Monterey, not Ventura. Am I still covered?

The macOS system fix shipped in macOS Ventura 13.2.1. On Big Sur and Monterey, the WebKit fix arrives through Safari 16.3, so install that Safari update from Software Update to remediate the browser path on those systems.

What does an attacker actually need to exploit this?

No credentials, but user interaction is required (UI:R). The victim has to process maliciously crafted web content - typically visiting a malicious page or opening attacker-controlled HTML rendered by WebKit. That triggers the type confusion and can lead to arbitrary code execution in the content process.

Is CVE-2023-23529 the same as the kernel bug Apple patched at the same time?

No. CVE-2023-23529 is the WebKit type confusion flaw. Apple patched it alongside a separate kernel vulnerability (CVE-2023-23514) in the same 16.3.1 / 13.2.1 update cycle. WebKit and kernel bugs are often chained, which is why you should install the full update rather than only one component.

References

Assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Additional nearby issues sensible to fix in the same maintenance window:

People also ask

Which exact versions fix CVE-2023-23529?

Apple fixed it in iOS 16.3.1 and iPadOS 16.3.1, iOS 15.7.4 and iPadOS 15.7.4 for older devices, macOS Ventura 13.2.1, and Safari 16.3. Any of these builds or later on the matching platform closes the flaw.

I am on macOS Big Sur or Monterey, not Ventura. Am I still covered?

The macOS system fix shipped in macOS Ventura 13.2.1. On Big Sur and Monterey, the WebKit fix arrives through Safari 16.3, so install that Safari update from Software Update to remediate the browser path on those systems.

Is CVE-2023-23529 actively exploited?

Yes. Apple states it is aware of a report that this issue may have been actively exploited, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-02-14, with a federal remediation deadline of 2023-03-07.