Vulnerability Spotlight: Remote code execution vulnerability Apple Safari
Summary: Cisco Talos researcher Marcin "Icewall" Noga discovered a remote code execution vulnerability in Apple Safari's WebKit feature, where an attacker could trigger a use-after-free condition in WebCore, the DOM-rendering system for WebKit used in Safari. A user must open a specially crafted malicious web page in Safari to trigger it, and Talos worked with Apple under its coordinated disclosure policy to resolve the issue and make an update available, with Snort rules 54586 and 54587 detecting exploitation attempts.
Bottom line: The flaw was confirmed in Safari/WebKit version 13.0.2 and requires only that a victim visit a malicious web site, so the exposure sits in ordinary browsing rather than any unusual user action.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-9951
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026