CVE-2022-22620 is a webkit use-after-free vulnerability in Apple iOS, iPadOS, and macOS. CISA added it to the Known Exploited Vulnerabilities catalogue on 11 February 2022, which means attackers have used it in real attacks. Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content.
What this vulnerability means in Apple WebKit
WebKit is the browser engine behind Apple’s in-app and system browser experiences, so a use-after-free in that code path is dangerous because malformed web content can make the engine operate on memory after it has been freed. In practice, that can turn ordinary browsing into a code execution path.
For a vulnerability of this class, the key point is not just that a crash may occur. A use-after-free can corrupt the engine’s control flow or data structures in ways that attackers can often shape into arbitrary behavior, especially when the flaw is reachable through content the user only has to view.
Why this kind of flaw is high impact
Browser engine vulnerabilities are attractive because they sit on a widely exposed attack surface and are triggered by content parsing, rendering, or script handling. When the affected component is embedded across iOS, iPadOS, and macOS, the same weakness can matter across multiple device classes and user populations.
Because the issue is in WebKit processing maliciously crafted web content, exposure can arise from many entry points: web pages, embedded browser views, previews, or other places where the engine renders untrusted content. That makes the blast radius broader than a single app bug.
CVE Program is the authoritative reference for the identifier itself, while the vendor advisory and CISA KEV entry are the places to confirm affected versions and remediation timing.
How organisations should assess exposure
Start with a complete inventory of Apple devices and the software paths that use WebKit, including managed endpoints and any internal applications that embed browser functionality. If you do not know where WebKit is present, you do not know where the exposure sits.
Then check whether those assets are internet-facing, user-facing, or likely to open untrusted web content. The practical question is not only “Is the product installed?” but also “Can an attacker plausibly deliver crafted content to it?”
NIST National Vulnerability Database helps teams correlate the CVE record with broader vulnerability tracking, while Vulnerability Management Guide covers the prioritisation logic for KEV-listed issues.
Remediation, detection, and post-patch review
When a vendor patch is available, remediation should be treated as urgent because KEV inclusion means the flaw has already been used in real attacks. If patching is delayed, reduce exposure by limiting untrusted web content, tightening browser and app allowlists, and minimizing unnecessary browsing on high-value systems.
Detection should focus on signs that the engine was abused before remediation, including unusual browser crashes, renderer instability, suspicious web activity, or linked evidence of post-exploitation tooling. After patching, review whether the same device showed signs of compromise before the fix was applied.
Where exploitation is suspected, treat browser sessions, downloaded artefacts, and any tokens or credentials used on the affected device as potentially exposed. The exact response depends on what the endpoint was used to access, but post-compromise review should not stop at patch verification alone.
CWE Top 25 Guide is useful for understanding why use-after-free weaknesses are so often security-critical, and The State of NHI & AI Agent Breach Report 2026 reinforces why post-compromise credential review matters after a successful intrusion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE is an exploited vulnerability requiring prioritisation and remediation tracking. |
| Recommendation — Prioritise KEV-listed vulnerabilities for rapid remediation and verification. | ||
| NIST CSF 2.0 | PR.PS-06 — Protective Technology | Web content exploitation on endpoints is reduced by protective control hardening and safe configuration. |
| DE.CM-01 — Networks and Devices Are Monitored to Detect Anomalous Activity | Exploitation may surface through unusual crashes or suspicious browser behaviour that monitoring can catch. | |
| Recommendation — Harden endpoint protective settings to limit hostile web content impact. Monitor endpoint and browser telemetry for signs of exploitation and instability. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | A KEV-listed WebKit flaw requires timely remediation and verification of patched systems. |
| SI-4 — System Monitoring | Post-exploitation review depends on monitoring for anomalous process and browser activity. | |
| Recommendation — Apply and verify the vendor fix for the affected WebKit components. Collect and review telemetry for indicators of exploitation and post-patch compromise. | ||
Practitioner Guidance
Why practitioners should care: A browser-engine memory corruption issue is not a routine stability bug when it is publicly exploited and can be triggered by crafted content. Treat it as an exposure management problem, not just a software update task.
What to watch for: Prioritise systems that routinely process untrusted content, especially managed endpoints used by executives, developers, and support staff who open many external links or web-based documents. Those systems often have the highest practical exposure even when the fleet is large.
Practitioner takeaway: Patch first, then verify whether the device had already been exposed to hostile content and whether any downstream identity or session material needs review.