An Autopsy on a Zombie In-the-Wild 0-day
Summary: Google Project Zero's Maddie Stone traced CVE-2022-22620, a Safari use-after-free that Apple first fixed in 2013, was reintroduced in December 2016 during refactoring, and was disclosed as exploited in the wild in January 2022. The 2016 commit changed the stateObject argument in FrameLoader::loadInSameDocument from a reference-counted PassRefPtr to a raw pointer, and the bug survived five years until the 2022 patch restored a RefPtr.
Why it matters: Project Zero noted that 25% of the 0-days disclosed as exploited in the wild in 2020 were variants of previously disclosed vulnerabilities, and said 2022 was tracking similarly - meaning a fully patched bug can return through a large refactor and be exploited years later.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-22620
- Related
- CVE-2022-22620: Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability Known Exploited Vulnerabilities · Feb 11, 20222022 0-day In-the-Wild Exploitation…so far Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026