CVE-2021-30665 is a webkit memory corruption vulnerability in Apple Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content.
How this vulnerability class works
WebKit memory corruption vulnerabilities are especially dangerous because they can turn a visit to a malicious page into code execution inside a trusted browser engine. On Apple platforms, that means the flaw can affect web content handling across multiple products, not just a single app or site.
Memory corruption in a browser engine matters because the browser is a high-value entry point, processes untrusted content constantly, and often sits at the boundary between normal browsing and device compromise. Once the rendering engine is exploited, the attacker may be able to run code in the context of the affected process and chain that into broader device abuse.
Why browser engine exploitation is high impact
Browser engines interpret complex, attacker-controlled input at scale, so even a single logic or memory-safety flaw can be reachable from ordinary user activity. That makes WebKit bugs a common path to initial compromise, particularly when the malicious content requires only a page load rather than a file download or deliberate installation.
The danger increases when the vulnerable engine is embedded in an operating system ecosystem used across phones, tablets, desktops, watches, and media devices. A successful exploit can become a cross-device threat pattern because the same rendering stack is reused in more than one product family.
For background on the vulnerability record itself, use the CVE Program for the canonical identifier and NIST National Vulnerability Database for record details and downstream reference material.
How organisations assess exposure and recovery
Exposure assessment starts with knowing where the affected browser engine is present, which managed devices are internet-facing, and which users are likely to encounter hostile web content. For exploited browser flaws, asset inventory and rapid vendor advisory review are more important than static assumptions about who “usually” browses risky sites.
When a patch cannot be applied immediately, organisations should treat browser hardening and exposure reduction as temporary risk controls, not substitutes for remediation. That usually means reducing reachability to untrusted content, tightening endpoint oversight, and validating that the vulnerable engine version is actually absent from the estate after remediation.
For a structured vulnerability response model, see the Vulnerability Management Guide, which covers asset scoping, KEV prioritisation, exceptions, and verification workflows.
Detection and post-exploitation review
Because exploitation can begin with web content, defenders should look for signs that the browser process behaved abnormally before a crash, reset, or suspicious follow-on activity. In practice, post-patch review should not stop at “the browser was updated”, because successful exploitation may already have enabled token theft, secondary payload delivery, or local persistence.
That review is especially important when users accessed unfamiliar links, received drive-by content, or showed signs of session abuse soon after the event. A browser exploit rarely stays isolated if the attacker can leverage the resulting foothold into credential access or lateral movement.
For broader exploitation patterns that often follow initial access, the State of NHI & AI Agent Breach Report 2026 is useful context for how stolen secrets and sessions are commonly abused after compromise.
Risk and Threat Considerations
Browser-engine memory corruption is a practical threat because it can be exploited through content the user expects to be safe, and because successful exploitation often gives attackers a foothold on a trusted endpoint. The main risk is not the bug description itself, but the combination of user exposure, broad product reach, and the ability to chain code execution into broader compromise.
Failure mechanism: Malicious web content triggers WebKit memory corruption, the rendering process misbehaves or executes attacker-controlled code, and the attacker uses that execution to expand access on the device or pivot into browser-held secrets and sessions.
Impact: The result can include remote code execution, device compromise, credential or session theft, and a launch point for further exploitation if the endpoint is used for email, identity access, or privileged administration.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1189 — Drive-by Compromise | Browser content exploitation is the classic drive-by entry path for this CVE. |
| Recommendation — Monitor web-delivered initial access techniques and correlate them with browser exploit telemetry. | ||
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | Malicious web content can deliver exploit code through browser processing. |
| SI-10 — Information Input Validation | The vulnerability exists in unsafe handling of untrusted web content inputs. | |
| Recommendation — Apply SI-3 to inspect and block hostile web-delivered code paths. Harden input validation for all untrusted content processing paths. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and information systems are monitored to detect potential cybersecurity events | Browser exploitation is best detected through endpoint and network monitoring signals. |
| Recommendation — Monitor endpoint and network activity for exploit indicators and anomalous browser behavior. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The CVE is KEV-listed and requires prioritised exposure management and remediation. |
| Recommendation — Prioritise and remediate KEV-listed browser vulnerabilities across the fleet. | ||