HowToFixMe
● High · CVSS 8.6 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2023-32409: Apple WebKit Web Content Sandbox Escape

⚡ At a glance
SeverityCVSS 3.1 base 8.6 (High). vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Vulnerability typeWebKit Web Content sandbox escape (remote). Not a denial-of-service flaw.
Actively exploited?Yes. Apple reports possible active exploitation; CISA KEV added 2023-05-22, federal due date 2023-06-12.
AffectedSafari before 16.5; iOS/iPadOS before 16.5 and the 15.7.x line; macOS Ventura before 13.4; tvOS before 16.5; watchOS before 9.5
Fixed inSafari 16.5, iOS/iPadOS 16.5, iOS/iPadOS 15.7.8, macOS Ventura 13.4, tvOS 16.5, watchOS 9.5
Type (CWE)CWE-noinfo (not categorized by the CNA); root cause was a bounds-checking defect fixed with improved bounds checks

Exploitation status

CVE-2023-32409 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on as “Apple Multiple Products WebKit Sandbox Escape Vulnerability”, which makes patching mandatory for U.S. federal agencies under Binding Operational Directive 22-01. Federal agencies were required to remediate it by . If you run an affected system, treat this as an emergency change, not a scheduled one.

Public exploit availability: although a public exploit is not directly linked in this CVE’s primary references, its place on the CISA KEV catalog confirms working attack code is in active use in the wild, treat weaponization as certain and patch on an emergency timeline.

Authoritative references:

CVE-2023-32409 is a vulnerability in WebKit, the browser engine that Apple ships across every one of its platforms. The flaw lets a remote attacker break out of the Web Content sandbox. In plain terms: when you open a malicious web page, the code on that page is supposed to stay locked inside a tightly confined process. This bug breaks that confinement, letting attacker-controlled code reach beyond the renderer and interact with the rest of the system. Apple addressed it with improved bounds checks, and Apple states it is aware of a report that the issue may have been actively exploited. CISA agrees: it sits on the Known Exploited Vulnerabilities catalog.

What this flaw actually is

This is a sandbox escape, not a denial-of-service bug and not a straightforward remote code execution bug on its own. The distinction matters when you prioritize. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N, which decodes to a network-reachable, low-complexity flaw needing no privileges and no user interaction beyond loading content, with a changed scope and a high integrity impact but no rated confidentiality or availability impact. The changed scope is the tell: the bug lets a payload affect resources outside the security boundary it started in. That is exactly what "break out of the Web Content sandbox" means.

Sandbox escapes are rarely the whole attack. On Apple platforms the Web Content process is deliberately stripped of privileges so that a memory-corruption bug in the renderer cannot, by itself, take over the device. An attacker chains a renderer bug to get code running inside that locked process, then uses a sandbox-escape bug like this one to climb out and do real damage. Because CVE-2023-32409 was flagged as exploited in the wild, you should assume it was already a working link in such a chain when Apple shipped the fix.

The underlying defect was a bounds-checking error: code that read or wrote outside the limits it should have respected, which Apple corrected with stricter bounds checks. The CNA did not assign a specific CWE (the record carries CWE-noinfo, "not enough information"), so treat the category as a memory-safety / improper-bounds-check issue rather than inventing a more precise label.

Who is affected

WebKit is system-wide on Apple platforms, so this is not just a Safari problem. On iOS and iPadOS, every browser. Chrome, Firefox, Edge, Brave, is required to use WebKit under the hood, so they are all affected until the OS is patched. On macOS, Safari uses WebKit directly, and many other apps render web content through WebKit views (Mail message rendering, in-app help, embedded web views in third-party apps). Apple TV (tvOS) and Apple Watch (watchOS) ship WebKit too. If a device runs a build below the fixed version for its platform, it is exposed.

Fixed versions

Apple shipped the fix on 2023-05-18 across the whole platform family. Update to or above the version listed for your device:

There is no configuration workaround and no partial mitigation that substitutes for the update. Because the flaw is actively exploited and reachable from a single web page with no user interaction, the only real fix is installing the patched build.

How to apply the fix

iPhone and iPad (iOS / iPadOS)

  1. Open Settings → General → Software Update.
  2. Install iOS/iPadOS 16.5 or later. On a device limited to the 15.x line, install 15.7.8.
  3. Let the device reboot to complete the install, then reopen Software Update and confirm it reports "up to date".

Mac (macOS Ventura, or Safari on Big Sur / Monterey)

  1. Open System Settings → General → Software Update (or System Preferences → Software Update on Big Sur / Monterey).
  2. On Ventura, install macOS Ventura 13.4 or later: this carries the WebKit fix.
  3. On Big Sur or Monterey, where the OS update is separate from the browser, install Safari 16.5 from the same Software Update pane.
  4. Reboot if prompted and verify the build afterwards.

Apple TV and Apple Watch

  1. Apple TV: Settings → System → Software Updates → install tvOS 16.5 or later.
  2. Apple Watch: on the paired iPhone, open the Watch app → General → Software Update → install watchOS 9.5 or later. Keep the watch on its charger and near the phone during the update.

Fleet and MDM

If you manage Apple devices through an MDM (Jamf, Kandji, Intune, or similar), push the minimum-OS requirement to the fixed builds above and enforce it. For supervised devices you can mandate the update and set an installation deadline. Given the KEV listing, treat this as an emergency push rather than waiting for your normal patch ring.

How to verify the patch landed

  1. iOS / iPadOS: Settings → General → About → check the Software Version reads 16.5 (or 15.7.8) or higher.
  2. macOS: Apple menu → About This Mac shows Ventura 13.4 or higher; in Safari, Safari → About Safari shows 16.5 or higher.
  3. tvOS / watchOS: re-open the Software Update screen and confirm it reports the device is up to date.

A version at or above the fixed build for the platform is the proof the bounds-check fix is present. There is no separate log entry to hunt for.

Frequently asked questions

Is CVE-2023-32409 actively exploited?

Yes. Apple states it is aware of a report that the issue may have been actively exploited, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-05-22. Federal civilian agencies had a remediation due date of 2023-06-12; most enterprises treat that date as the practical floor.

What does an attacker actually gain from this bug?

The ability to break out of the Web Content sandbox, the boundary that confines a malicious web page to a low-privilege process. Escaping it lets attacker code reach the wider system, which is why it is typically chained with a renderer bug for a full device compromise. CVSS is 8.6 (High) with a changed scope and high integrity impact.

Which versions fix it?

Safari 16.5, iOS/iPadOS 16.5 (or 15.7.8 on older devices), macOS Ventura 13.4, tvOS 16.5, and watchOS 9.5. Updating to or above the build for your platform closes the flaw.

I use Chrome on my iPhone, not Safari. Am I safe?

No. On iOS and iPadOS every browser is built on WebKit, so the bug reaches them all until you install the OS update. The fix is the OS or Safari update, not switching browsers.

References

Related guides worth a look while you sort this one out:

People also ask

Is CVE-2023-32409 actively exploited?

Yes. Apple reports it is aware of a report that the issue may have been actively exploited, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-05-22 as an Apple WebKit sandbox escape. The federal remediation due date was 2023-06-12.

What is CVE-2023-32409 and what does an attacker gain?

It is a WebKit flaw that lets a remote attacker break out of the Web Content sandbox, the boundary confining a malicious web page to a low-privilege process. Escaping it lets attacker code reach the wider system. CVSS 3.1 is 8.6 (High), vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N, with a changed scope and high integrity impact.

Which versions fix CVE-2023-32409?

Safari 16.5, iOS/iPadOS 16.5 (or 15.7.8 on older devices), macOS Ventura 13.4, tvOS 16.5, and watchOS 9.5. Update to or above the build for your platform.

I only use Chrome or Firefox. Am I still affected?

Yes. The bug is in WebKit, the system engine. On iOS and iPadOS every browser uses WebKit; on macOS many apps render web content through WebKit. The OS or Safari update is what closes it, regardless of which browser you prefer.