CVE-2023-28204 is a webkit out-of-bounds read vulnerability in Apple Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalogue on 22 May 2023, which means attackers have used it in real attacks. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content.
What the vulnerability means in practice
WebKit out-of-bounds read flaws matter because the browser engine processes untrusted web content at very high frequency and with broad trust. A read past the intended memory boundary can expose sensitive in-memory data even when the attacker cannot directly execute code.
For a CVE page, the practical question is not only “what is the bug?” but “what does exposure look like across the affected browser and operating-system ecosystem?” Apple’s own products and CISA’s KEV catalogue are the authoritative places to confirm product coverage and patch status, while the CVE Program and NIST National Vulnerability Database help anchor the record and downstream security workflow.
Why out-of-bounds reads are dangerous
An out-of-bounds read is primarily an information-disclosure weakness. In a browser engine, that can mean leaking process memory that may contain page data, security tokens, session material, or other secrets that should never be visible to web content.
The danger is amplified because browser components sit at the boundary between hostile content and local trust. Even a “read-only” flaw can become a stepping stone in a larger intrusion when the leaked data helps an attacker bypass isolation, understand memory layout, or support follow-on exploitation.
How organisations assess exposure
Exposure assessment starts with asset inventory, because organisations need to know where Apple operating systems and Safari WebKit are present and which devices can render untrusted web content. Internet exposure matters too: browsers used on unmanaged endpoints, shared devices, or internet-facing workflows often create the quickest path to exploitation.
Vendor advisories remain the source of truth for version-specific remediation, but triage should also account for where the software is used, whether update deferral exists, and whether any compensating controls reduce the likelihood of successful delivery. The Vulnerability Management Guide is a useful companion for prioritising internet-reachable vulnerabilities against KEV-listed issues.
Remediation, detection, and post-incident review
When patching is delayed, organisations should reduce the chance of hostile web content reaching vulnerable browsers, tighten user exposure to untrusted sites, and watch for anomalous browser behaviour or signs that sensitive information may already have been exposed. After patching, the review should focus on whether the vulnerability was exploited before remediation, not just whether the fix is now installed.
If exploitation is suspected, rotate any credentials, sessions, or other secrets that could reasonably have been resident in the affected browser process or adjacent application context. Memory-disclosure flaws often leave no obvious artefact in the browser itself, so post-patch investigation needs to combine endpoint logs, web access history, and broader incident-scoping evidence.
Risk and Threat Considerations
This kind of flaw is dangerous because it can be triggered through ordinary browsing paths, making exploitation scale well once malicious content is delivered. The main security consequence is silent disclosure, which can support later account compromise, session reuse, or follow-on intrusion even without direct code execution.
Failure mechanism: Maliciously crafted web content drives WebKit into reading memory outside the intended buffer, exposing data that the browser process had no reason to reveal.
Impact: Attackers may recover sensitive information that helps them bypass controls, refine exploitation, or steal secrets already present in memory.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE requires discovery, prioritisation, and remediation of an exploited browser vulnerability. |
| Recommendation — Prioritise, patch, and verify exploited browser vulnerabilities using continuous vulnerability management. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | The term concerns an exploitable software weakness that must be found and tracked across assets. |
| SI-2 — Flaw Remediation | The CVE represents a software flaw requiring remediation and verification after update release. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Exploitation review depends on analysing logs and endpoint evidence after suspected abuse. | |
| Recommendation — Scan for vulnerable Apple and Safari assets and track remediation until exposure is eliminated. Apply flaw remediation processes to deploy fixes and confirm vulnerable versions are no longer present. Review logs and endpoint records to determine whether the WebKit flaw was exploited before patching. | ||
Practitioner Guidance
Why practitioners should care: Browser-engine vulnerabilities are high-value because they sit on a common attack path and can affect many users at once. For organisations that rely on Apple endpoints, the operational issue is less about the abstract CVE and more about how quickly devices are identified, updated, and verified.
What to watch for: Treat CISA KEV inclusion as a strong prioritisation signal, then verify that affected Apple products are actually covered in your asset and patch records. Where the vulnerability has been exploited in the environment, review any nearby accounts, sessions, or credentials that may have been exposed during use of the vulnerable browser.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org