Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-28204, CVE-2023-32373, CVE-2023-32409)

Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-05-22.

Why this severity: CVSS 8.8 (NVD), actively exploited (CISA KEV)

Started

May 22, 2023

Closed

May 22, 2023

CVEs

CVE-2023-28204CVE-2023-32373CVE-2023-32409

• Apple
• iOS
• macOS
• CISA KEV
• #Safari
• #WebKit

Notes & caveats

Derived from CISA KEV JSON feed catalogVersion 2026.10.21. Exact affected/fixed version strings are not always in the KEV record — verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier). Grouped: same vendor/product added to KEV on the same day.