How to Fix CVE-2023-28204: WebKit Out-of-Bounds Read in Apple Safari, iOS and macOS

Apple shipped this fix as part of a larger WebKit security release. The same builds also close CVE-2023-32373 (a WebKit use-after-free that can lead to arbitrary code execution) and CVE-2023-32409 (a WebKit sandbox escape). Updating to the version in the table closes all three at once, so there is no benefit to patching them piecemeal.

What is CVE-2023-28204?

CVE-2023-28204 is an out-of-bounds read in WebKit, the browser engine that powers Safari and every web view on Apple's operating systems. Apple's own description is blunt: “Processing web content may disclose sensitive information.” The classification is CWE-125 (Out-of-bounds Read), and the company has acknowledged a report that the flaw may have been actively exploited in the wild.

The mechanics matter for how you triage this. An out-of-bounds read means WebKit, while parsing a maliciously crafted page, reads memory past the boundary of an allocated buffer. It does not write anywhere it should not, so it is not a corruption or code-execution primitive on its own. Instead it leaks whatever bytes happen to sit in that adjacent memory back into a context the page can observe. On a browser engine that adjacent memory can contain pointers, tokens, fragments of other tabs' data, or values an exploit chain needs to defeat address-space layout randomisation (ASLR). That last use is why a “mere” info-leak ends up in the CISA Known Exploited Vulnerabilities catalog: it is a building block in real iOS and macOS attack chains, paired here with WebKit memory-corruption bugs in the same release.

The CVSS vector backs this reading. CVE-2023-28204 scores 6.5 (Medium) with the string AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. Read that as: reachable over the network (a web page), no privileges needed, but it requires user interaction, the victim has to open or be steered to attacker-controlled content. The impact is confidentiality High, integrity None, availability None. In plain terms: this bug leaks data, it does not by itself crash the device or run code. Anyone telling you CVE-2023-28204 is “remote code execution” is describing the wrong CVE. likely one of its release siblings.

Who is affected

Because the bug lives in WebKit and not in Safari's UI layer, the blast radius is wider than “people who use Safari.” On iOS, iPadOS, watchOS and tvOS, every browser is required to use WebKit, and any app that renders web content through WKWebView or SFSafariViewController inherits the same engine. Updating Chrome or Firefox on an iPhone does nothing here, the operating system update is the fix. On macOS the exposure is narrower (third-party browsers ship their own engines), but Safari and any WebKit-based app on an unpatched system are still in scope.

Use the Affected and Fixed in rows in the at-a-glance table as your checklist. Note the split on iOS/iPadOS: devices that can run iOS 16 get the fix in 16.5, while older hardware stuck on the iOS 15 line gets it in 15.7.6. macOS Big Sur and Monterey users do not get a full OS bump for this: they receive the WebKit fix through Safari 16.5 as a standalone update.

How to fix CVE-2023-28204

There is no configuration workaround and no patch to compile. The remediation is to install the Apple release that contains the fixed WebKit, then confirm the build. Pick the path that matches the device.

iPhone and iPad (iOS / iPadOS)

1. Open Settings → General → Software Update.
2. Install iOS 16.5 / iPadOS 16.5 if the device offers it. On older hardware that tops out at iOS 15, install iOS 15.7.6 / iPadOS 15.7.6 instead.
3. Reboot if the installer does not do so automatically, then re-open Settings → General → Software Update to confirm the device reports “up to date.”

Mac (macOS and Safari)

1. On macOS Ventura, open System Settings → General → Software Update and install macOS Ventura 13.4 (or later).
2. On macOS Big Sur or Monterey, you do not get a 13.4 bump, instead update Safari to 16.5 via System Preferences → Software Update. The Safari update carries the patched WebKit.
3. Quit and relaunch Safari (and any other WebKit app) so the new engine is loaded.

Apple Watch and Apple TV

1. watchOS: on the paired iPhone, open the Watch app → General → Software Update and install watchOS 9.5. Keep the watch on its charger and within range during the update.
2. tvOS: on the Apple TV, go to Settings → System → Software Updates → Update Software and install tvOS 16.5.

Managed fleets (MDM)

If you run an MDM such as Jamf, Intune, Kandji or Mosyle, you do not patch WebKit directly. you drive the OS update through the management channel. On supervised iOS/iPadOS devices, push the ScheduleOSUpdate MDM command (or the equivalent automated-update policy in your console) targeting 16.5 or 15.7.6. For Macs, deploy the macOS 13.4 update or the Safari 16.5 software-update item, and set a hard install deadline given the active-exploitation status. Then report on compliance by OS version:

# Jamf Pro: build a Smart Group whose criteria flag still-vulnerable devices
#   "Operating System Version"  is less than  16.5      (iOS/iPadOS 16 line)
#   "Operating System Version"  is less than  15.7.6    (iOS/iPadOS 15 line)
#   "Operating System Version"  is less than  13.4      (macOS Ventura)
# Scope the OS-update policy / Software Update plan to that group,
# then watch the group drain to zero as devices report in.

Verify the fix landed

Confirm the build on the device itself, not from an inventory cache that may be stale:

# iPhone / iPad:  Settings -> General -> About -> Software Version
#   Must read 16.5 (or later) on the iOS 16 line, or 15.7.6 (or later) on the iOS 15 line.
# Mac:            Apple menu -> About This Mac    -> macOS 13.4 (or later)
#                 Safari -> About Safari          -> 16.5 (or later) on Big Sur / Monterey
# Apple Watch:    Watch app -> General -> About   -> Version 9.5 (or later)
# Apple TV:       Settings -> General -> About     -> tvOS 16.5 (or later)

If you maintain a vulnerability scanner (Nessus, Qualys, Tenable, Rapid7), re-run an authenticated scan after the rollout; the device should stop flagging CVE-2023-28204 once it reports a fixed build. Because the bug is exploited as part of a chain, also confirm the sibling WebKit CVEs in the same release (CVE-2023-32373, CVE-2023-32409) clear at the same time.

If you can't patch immediately

Apple published no configuration workaround for CVE-2023-28204, updating is the only real fix, and given active exploitation it should not wait. If a device genuinely cannot be updated on schedule, the practical risk reducers all key off the “user interaction required, web content” nature of the bug: avoid opening untrusted links, prefer not to follow links from unknown senders in Messages or Mail, and keep Lockdown Mode in mind for high-risk individuals: it hardens WebKit's handling of web content and disables several attack surfaces this class of bug relies on. None of these are substitutes for the update; they only narrow the window until you can install it.

Frequently asked questions

Is CVE-2023-28204 being exploited right now?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2023-05-22, and Apple's own advisory states it is aware of a report that the issue may have been actively exploited. Treat patching as urgent on any device still on a pre-fix build.

What version do I update to for CVE-2023-28204?

Apple fixed it in iOS 16.5 and iPadOS 16.5, iOS 15.7.6 and iPadOS 15.7.6 for older hardware, macOS Ventura 13.4, Safari 16.5 (for macOS Big Sur and Monterey), watchOS 9.5, and tvOS 16.5. Update to whichever matches your device and stay at or above it.

Is CVE-2023-28204 remote code execution?

No. It is an out-of-bounds read (CWE-125) in WebKit. Processing crafted web content can disclose sensitive information from memory, but the record is information disclosure (CVSS confidentiality High, integrity and availability None), not code execution. It was patched alongside CVE-2023-32409, a WebKit sandbox escape, in the same release, which is why the two are easy to confuse.

I only use Chrome or Firefox. Am I still affected?

On iPhone, iPad, Apple Watch and Apple TV, yes, every browser there is required to use WebKit, and so is any app that shows web content through WKWebView or SFSafariViewController. The OS update is the fix, not a browser swap. On a Mac, third-party browsers ship their own engines, but Safari and other WebKit apps on an unpatched system are still exposed, so update macOS or Safari anyway.

References

• Official vendor advisory: https://support.apple.com/en-us/HT213758
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-28204
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://support.apple.com/en-us/HT213762
• https://support.apple.com/en-us/HT213764
• https://support.apple.com/en-us/HT213765
• https://support.apple.com/en-us/HT213757

How CVE-2023-28204 fits the 2023 WebKit chain

This CVE rarely stands alone. Apple disclosed it in the same May 2023 round as CVE-2023-32409, a WebKit flaw that let remote content break out of the Web Content sandbox, and credited the pairing to researchers at Google's Threat Analysis Group and Amnesty International's Security Lab. the teams that track mercenary spyware. That attribution, plus the KEV listing, is the tell: an out-of-bounds read like CVE-2023-28204 supplies the information leak (memory addresses, ASLR-defeating data) that a sandbox-escape or memory-corruption bug then turns into full device compromise. On its own it leaks; chained, it is a step toward implant delivery.

The operational takeaway is simple. Do not let the “Medium / 6.5” score lull you into a slow patch cycle. KEV puts this on a days-not-weeks clock, and because every fix lives in a single OS or Safari update, you close the whole WebKit cluster, info-leak and code-execution siblings together: with one rollout. Patch the OS, verify the build, and confirm your scanner clears all the related CVE IDs in the release.

This guide was assembled from the Apple security advisory, the MITRE CVE record (CVE-2023-28204), the CISA KEV listing, and the CISA ADP CVSS/CWE enrichment. Always confirm the exact build against the linked Apple advisory before relying on it in production.

Related fixes

Related guides worth a look while you sort this one out:

• How to Fix CVE-2023-0016: SQL Injection in SAP BPC MS 10.0
• How to Fix CVE-2023-0018: Cross-Site Scripting in BusinessObjects Business Intelligence Platform (Central management con
• How to Fix CVE-2023-0022: Improper Control of Generation of Code ('Code Injection' in BusinessObjects Business Intellige
• How to Fix CVE-2023-0266: Use-After-Free in Linux Kernel
• How to Fix CVE-2023-0386: Linux Kernel OverlayFS Privilege Escalation
• How to Fix CVE-2023-0669: Insecure Deserialization in Goanywhere MFT