Known Exploited Vulnerabilities May 22, 2023 · CISA KEV Catalog

CVE-2023-28204: Apple Multiple Products Web Kit Out-of-Bounds Read Vulnerability

Summary: CVE-2023-28204 is an out-of-bounds read vulnerability in WebKit, the engine behind Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari, that may disclose sensitive information when processing maliciously crafted web content. The flaw also affects HTML parsers that use WebKit, including Apple Safari and non-Apple products that rely on WebKit for HTML processing, and CISA set a remediation due date of 2023-06-12.
What's compelling: The exposure is not confined to Apple devices: any product that leans on WebKit to parse HTML inherits the same out-of-bounds read, so an inventory limited to iPhones and Macs will miss part of the attack surface.

Read the original at CISA KEV Catalog ↗

Topics: Vulnerabilities & Patching
Mentions: Apple CVE-2023-28204
Related: CVE-2024-27834: Apple Multiple Products Improper Authentication Vulnerability Known Exploited Vulnerabilities · Nov 04, 2026
CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Sep 29, 2026
CVE-2026-65400: Apple macOS Improper Authentication Vulnerability Known Exploited Vulnerabilities · Aug 18, 2026