Yes. CISA added CVE-2021-30661 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content.
What “exploited in the wild” means for this CVE
For a CVE such as CVE-2021-30661, “exploited in the wild” means defenders should treat it as an active threat, not just a theoretical weakness. The practical question is whether the affected Apple platforms could have been exposed to malicious web content before remediation, and whether the organisation still has any systems that may have remained reachable through outdated browsers, embedded web views, or delayed updates.
Because the flaw sits in WebKit Storage and is triggered by maliciously crafted web content, exposure is not limited to a single app workflow. That makes browser hygiene, operating system patch level, and the use of managed browsers materially relevant to the answer. The right first check is whether any Apple devices remained on vulnerable software long enough to encounter untrusted content.
Managed browser policy matters here, because browser-driven code execution often becomes a broader endpoint issue when users can run untrusted extensions, keep stale sessions open, or browse with weak isolation. NHI Management Group’s Enterprise Browser and Browser Security Guide is useful when the exposure path depends on browser hardening and credential protection rather than on the CVE alone.
How to confirm exposure and judge urgency
The simplest confirmation step is to identify every Apple endpoint and browser-dependent application that could have processed untrusted web content before the fix was applied. In practice, that means checking inventory, OS version, Safari usage, embedded web views, and whether any device was used for high-risk browsing, admin work, or access to sensitive applications. If the device was internet-facing and unpatched, assume exposure is possible until proven otherwise.
Urgency is driven by exploitability and business exposure, not by technical novelty. A use-after-free in a browser engine is especially important because successful exploitation can lead to code execution from ordinary browsing activity. That makes the vulnerability relevant to user endpoints, shared devices, and any environment where web content is routinely rendered with elevated trust.
For prioritisation, compare current exposure against known exploitation evidence and your own asset criticality. The public record should be checked against the authoritative vulnerability record in the CVE Program and the exploitation status in the CISA Known Exploited Vulnerabilities Catalog, then align remediation urgency with your endpoint risk.
Where vulnerability operations are formalised, the strongest next step is to use a structured remediation queue rather than ad hoc patching. NHI Management Group’s Vulnerability Management Guide is relevant because it maps active exploitation to asset scope, prioritisation and verification, which is exactly the decision path this CVE requires.
What to do when patching must wait
If immediate patching is delayed, the goal is to reduce the chance that the vulnerable browser engine can be reached by malicious content. That means tightening web access, limiting untrusted browsing on exposed devices, and increasing the value of remote browser isolation or equivalent containment on higher-risk endpoints. For systems that cannot be updated quickly, reduce the number of opportunities for a successful drive-by delivery.
When patching lags, monitoring should shift from general device health to evidence of attempted exploitation or abnormal browser behaviour. Watch for unexpected crashes, new processes spawned from browser sessions, suspicious downloads, unusual persistence, or changes in account sessions that suggest code execution occurred after page rendering. If the endpoint can reach sensitive sessions or secrets, treat browser compromise as a potential stepping stone rather than a local issue.
For organisations that already use formal triage around exploited flaws, the operational model in the Zero-Day and Exploited Vulnerabilities Guide is the right reference point for emergency mitigation, hotpatching and compromise assessment. The answer to this CVE is not just “patch it”, but “reduce exposure immediately if patching cannot happen today”.
Risk and Threat Considerations
This vulnerability matters because browser-engine flaws are often reachable through ordinary user activity, which gives attackers a low-friction initial access path. Once a malicious page or content payload is rendered, the compromise can move from a browser crash to code execution, and then to broader endpoint access if the system is not isolated or hardened.
Failure mechanism: A use-after-free in WebKit Storage can let crafted content corrupt memory in the browser process, creating a path to arbitrary code execution on an affected Apple device.
Impact: The likely consequence is endpoint compromise, which can expose sessions, local data, and adjacent credentials or tokens if the device was being used for trusted work.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes prioritised vulnerability handling central to this CVE. |
| Recommendation — Prioritise and remediate exposed Apple systems using continuous vulnerability management. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | This CVE requires confirming exposure and tracking remediation across assets. |
| SI-2 — Flaw Remediation | The exploit status makes timely remediation and verification the key control response. | |
| IR-4 — Incident Handling | Potential exploitation requires assessment, containment and compromise investigation. | |
| Recommendation — Scan affected endpoints and validate remediation status for the WebKit flaw. Apply the WebKit fix promptly and verify that remediation completed successfully. Treat suspected exploitation as an incident and preserve evidence for investigation. | ||
| OWASP ASVS | V13 — Configuration | Browser and platform hardening help reduce exposure while remediation is pending. |
| Recommendation — Harden browser and platform configuration to reduce exposure to malicious web content. | ||
Practitioner Guidance
What to prioritise: Start with internet-facing and high-trust Apple endpoints, then move to any device used for administrative access, SSO sessions or sensitive web applications. Those systems have the highest blast radius if browser exploitation succeeded.
What to verify: Confirm that every affected Apple platform is on a remediated build, and verify whether any suspicious browsing activity, browser crashes, or unexpected process launches occurred before remediation. If a device was unpatched and actively used, assume forensic review may be needed.
Decision rule: If the endpoint could have rendered untrusted web content before patching, treat the event as a possible compromise window, not just a patching task. If evidence of execution exists, rotate exposed sessions or secrets before closing the case.
Practitioner takeaway: For exploited browser CVEs, the real decision is whether you can still trust the endpoint state, not whether the patch exists; if trust is uncertain, containment and compromise assessment come before normal remediation closure.
Related resources from NHI Mgmt Group
- CVE-2021-30661 (Apple Multiple Products WebKit Storage Use-After-Free)
- Is CVE-2023-32373 (Apple Multiple Products WebKit Use-After-Free) being exploited in the wild?
- Is CVE-2023-43000 (Apple Multiple products Use-After-Free) being exploited in the wild?
- Is CVE-2019-8605 (Apple Multiple Products Use-After-Free) being exploited in the wild?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org