Known Exploited Vulnerabilities February 11, 2022 · CISA KEV Catalog

CVE-2022-22620: Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability

Summary: CVE-2022-22620 is a use-after-free vulnerability in the WebKit engine used by Apple iOS, iPadOS, and macOS that allows code execution when processing maliciously crafted web content. The flaw could affect HTML parsers built on WebKit, including Apple Safari and non-Apple products that rely on WebKit for HTML processing, and CISA set a remediation due date of 2022-02-25.

Bottom line: The vulnerable component is the rendering engine behind Safari and any non-Apple product built on WebKit, so a single malicious web page reaches every one of those clients; CISA's 2022-02-25 due date puts patching on a fixed clock, and known ransomware campaign use is listed as unknown.

Read the original at CISA KEV Catalog ↗

Topics

Vulnerabilities & Patching

Mentions

AppleCVE-2022-22620

Related

CVE-2024-27834: Apple Multiple Products Improper Authentication Vulnerability Known Exploited Vulnerabilities · Nov 04, 2026

CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Sep 29, 2026

CVE-2026-65400: Apple macOS Improper Authentication Vulnerability Known Exploited Vulnerabilities · Aug 18, 2026