Is CVE-2022-22620 (Apple iOS, iPadOS, and macOS Webkit Use-After-Free) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2022-22620 to its Known Exploited Vulnerabilities catalogue on 11 February 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content.

What this CVE means for real-world exposure

CVE-2022-22620 is not just a browser bug on paper. CISA’s inclusion in the CISA Known Exploited Vulnerabilities Catalog means defenders should treat it as an actively abused weakness, not a theoretical one. For Apple fleets, the practical question is whether exposed devices are still able to render untrusted web content without the fix or a compensating containment control.

Because the flaw sits in WebKit, the exposure surface is broader than a single app icon. Any iOS, iPadOS, or macOS workflow that relies on embedded web content, in-app browsing, or ordinary browsing can become the entry point if the vulnerable code path is reachable.

How exploitation typically translates into compromise

The direct security consequence is code execution from maliciously crafted web content. That usually means the attacker’s first objective is not data theft by itself, but gaining execution in a process that can then be chained into deeper access, persistence, or credential capture depending on the device state and the user’s privileges.

In practice, that makes the initial compromise window especially important. A WebKit exploit can be delivered through ordinary-looking content, so successful abuse may leave few obvious user-facing indicators until the attacker has already executed code and begun post-exploitation activity.

What to check, fix, and verify first

Start by confirming whether any Apple devices were still on the vulnerable software branch when CISA listed the CVE. The authoritative sources for version-level guidance are the vendor advisory and the CISA KEV catalogue, not secondary summaries, because the operational decision depends on the exact Apple release train and deployment state.

Where patching is available, treat it as the primary remediation. If patching must wait, reduce exposure by limiting use of untrusted web content, tightening device management policy, and ensuring the affected devices are not used for higher-risk tasks until they are updated.

After remediation, validate more than installation success. Review device logs, browser and web-content activity where available, and any endpoint telemetry for signs that the flaw may have been used before the fix landed. If a device handled sensitive credentials, corporate sessions, or privileged access, assume those pathways may need review as well.

Risk and Threat Considerations

This CVE matters because a memory corruption issue in a ubiquitous rendering engine can provide a quiet initial foothold across large device populations. The risk is highest where users routinely open untrusted links, receive web content through messaging or email, or mix personal browsing with managed access to corporate systems.

Failure mechanism: Malicious web content triggers the use-after-free condition in WebKit, allowing attacker-controlled code execution inside the browser content path. From there, the attacker may try to extend access, steal data, or stage additional malware depending on available permissions and defenses.

Impact: A successful exploit can compromise device integrity before the user recognises anything is wrong, which makes rapid patching and post-exploit review more important than waiting for a visible alert.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require urgent identification and remediation.
Recommendation — Prioritise, patch, and verify exposure for KEV-listed vulnerabilities.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	This CVE requires exposure confirmation and remediation tracking across Apple endpoints.
	SI-2 — Flaw Remediation	The issue is a software flaw with active exploitation that must be remediated promptly.
Recommendation — Continuously monitor assets and track remediation for known exploited vulnerabilities. Apply vendor fixes or mitigations quickly and verify deployment.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Recorded	The question asks whether a specific vulnerability is being exploited in the wild.
Recommendation — Record the vulnerable Apple platforms and track KEV status in risk decisions.
OWASP ASVS	V13 — Configuration	Browser and platform hardening help reduce exposure while patching is pending.
Recommendation — Harden browser and platform settings to reduce exploitable web-content exposure.

Practitioner Guidance

What to prioritise: Put affected Apple endpoints into a fast-track remediation queue, especially devices with active web use and any device that can reach sensitive internal services. KEV-listed exploitation changes the priority from routine patch hygiene to urgent exposure reduction.

What to verify: Confirm not only that the operating system is updated, but that the device was not used for privileged browsing, authenticated web sessions, or administrative access while exposed. That determines whether the issue ends at patching or expands into account and session review.

Decision rule: If a vulnerable device cannot be updated immediately, reduce its trust level for browser-based workflows until it is remediated. If there is any sign of suspicious web activity or unexplained instability, treat it as a possible compromise investigation, not just a maintenance issue.

Practitioner takeaway: For KEV-listed browser-engine flaws, the key judgement is not whether exploitation is possible, but whether the organisation has already assumed the device is trustworthy after it has processed hostile content.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org