CVE-2023-32409: Apple Multiple Products WebKit Sandbox Escape Vulnerability

CISA Known Exploited Vulnerabilities

Name

Apple Multiple Products WebKit Sandbox Escape Vulnerability

Vendor

Apple

Product

Multiple Products

Added to the catalog

2023-05-22

Due date for US federal agencies

2023-06-12

Catalog version

2026.10.30

Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Required action (CISA)

Apply updates per vendor instructions.

Ransomware use: CISA does not mark known use of this vulnerability in ransomware campaigns.

Links in CISA's notes

• https://support.apple.com/HT213757,
• https://support.apple.com/HT213758,
• https://support.apple.com/HT213761,
• https://support.apple.com/HT213762,
• https://support.apple.com/HT213764,
• https://support.apple.com/HT213765
• https://nvd.nist.gov/vuln/detail/CVE-2023-32409

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2023-06-23T18:15:13.183

Last modified

2026-06-17T05:58:47.027

Weaknesses

NVD-CWE-noinfo

The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.

References

• https://support.apple.com/en-us/HT213757 (Vendor Advisory)
• https://support.apple.com/en-us/HT213758 (Vendor Advisory)
• https://support.apple.com/en-us/HT213761 (Vendor Advisory)
• https://support.apple.com/en-us/HT213762 (Vendor Advisory)
• https://support.apple.com/en-us/HT213764 (Vendor Advisory)
• https://support.apple.com/en-us/HT213842 (Vendor Advisory)
• https://support.apple.com/en-us/HT213757 (Vendor Advisory)
• https://support.apple.com/en-us/HT213758 (Vendor Advisory)
• https://support.apple.com/en-us/HT213761 (Vendor Advisory)
• https://support.apple.com/en-us/HT213762 (Vendor Advisory)
• https://support.apple.com/en-us/HT213764 (Vendor Advisory)
• https://support.apple.com/en-us/HT213842 (Vendor Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-32409 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:42:08.214Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-32409

CVE record

Assigner

apple

State

PUBLISHED

Published

2023-06-23T00:00:00.000Z

Updated

2026-01-12T19:59:41.495Z

Problem types

A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.

The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.

References

• https://support.apple.com/en-us/HT213758
• https://support.apple.com/en-us/HT213762
• https://support.apple.com/en-us/HT213764
• https://support.apple.com/en-us/HT213842
• https://support.apple.com/en-us/HT213757
• https://support.apple.com/en-us/HT213761

Read on 2026-11-03T02:03:32.721Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/32xxx/CVE-2023-32409.json