CVE-2023-37450 is a webkit code execution vulnerability in Apple Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalogue on 13 July 2023, which means attackers have used it in real attacks. Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content.
Why this vulnerability matters in Apple’s web rendering stack
WebKit is the browser engine behind Safari and also used across Apple platforms, so a code execution flaw in that component can turn routine content rendering into a high-impact entry point. Because the vulnerability is triggered by maliciously crafted web content, the attacker does not need to persuade a user to install a separate executable.
In practice, that means the browser becomes the delivery mechanism, and the consequence depends on what the compromised process can reach next, including local data, active sessions, and trusted browsing context. For a broader view of how exploited vulnerabilities are triaged and tracked, NIST National Vulnerability Database and the CVE Program remain the canonical references.
How exploitation typically plays out
Code execution bugs in a browser engine are dangerous because they can be chained with a second flaw for sandbox escape, privilege escalation, or credential theft. Even when the initial foothold is limited to a browser process, attackers often use it to stage follow-on activity, collect tokens or cookies, and move into user workflows that are already trusted by the operating system.
This is why exploited browser-engine issues are often treated as internet-facing exposure problems rather than simple software bugs. Attackers favor them because web content is already expected, frequently parsed, and difficult to fully restrict without breaking normal use.
Exposure and remediation priorities
Organisations should first identify where Apple devices, Safari usage, and embedded WebKit surfaces exist in the estate, then confirm whether those systems are internet exposed, user facing, or business critical. Vendor advisories should be the source of truth for affected versions and fixes, while asset inventory tells you which endpoints still need attention.
When patching cannot be applied immediately, the practical goal is to reduce exposure to untrusted web content and tighten the blast radius of any successful execution. That usually means prioritising high-risk user groups, limiting unnecessary browsing pathways, and treating the issue as a tracked vulnerability-management item rather than a routine desktop update. The Vulnerability Management Guide is useful for structuring that prioritisation.
Detection and post-exploitation review
Detection is harder than prevention because successful exploitation may look like ordinary browser activity until a later stage of the attack reveals itself. Security teams should review endpoint telemetry, browser crash and anomaly patterns, suspicious child processes, unusual network destinations, and any post-exploitation signs that indicate the browser was used as an initial execution path.
After patching, the important question is whether the device was compromised before the fix landed. If there is evidence of exploitation, review browser sessions, saved credentials, authentication tokens, and any nearby accounts or services that could have been accessed from the affected endpoint. For incident patterns involving exploit-driven execution and follow-on abuse, the State of NHI & AI Agent Breach Report offers a useful breach-oriented lens, even though the mechanics here are browser-centric rather than agent-centric.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Browser engine flaws require tracked remediation and verification. |
| SI-4 — System Monitoring | Exploit aftermath is often detected through anomalous endpoint and browser activity. | |
| RA-5 — Vulnerability Monitoring and Scanning | Exposure assessment depends on inventorying vulnerable Apple products and installed WebKit surfaces. | |
| Recommendation — Prioritise and verify remediation for exploited WebKit defects across affected Apple endpoints. Monitor endpoint and browser telemetry for signs of code execution and post-exploit activity. Continuously identify Apple assets and confirm exposure to known WebKit vulnerabilities. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The term is an actively exploited CVE that requires prioritised vulnerability handling. |
| Recommendation — Track, prioritise, and remediate the exploited Apple WebKit issue using risk-based vulnerability management. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | Code-execution issues warrant strong logging to support detection and compromise review. |
| Recommendation — Retain security logs that help correlate browser exploitation with suspicious execution and follow-on actions. | ||