CVE-2021-1879mediumunder attackCWE-79

CVE-2021-1879: medium-severity vulnerability in Apple iOS

Published · Updated

Follow this CVE+ Monitor iOS+ Monitor iPadOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 6.1epss 7.1%
from disclosure to weapon
Published on NVDApr 2
CISA KEV+215d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A flaw in how Apple devices handle web content can allow attackers to inject malicious scripts that bypass security protections, potentially affecting any website you visit. This happens because the system doesn't properly manage how temporary objects are cleaned up after use.

Technical detail

A use-after-free vulnerability in object lifetime management allows XSS attacks to escape sandbox restrictions. Exploitation requires processing specially crafted web content; the flaw affects WebKit's memory handling and can lead to arbitrary script execution in the context of any origin.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited..
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Apple · iOSApple · iOS and iPadOSApple · watchOS
Related CVEs — Apple iOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 65.2%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 58.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2023-28205HIGHCVE-2023-28205EPSS 27.1%KEVCVE-2026-86950HIGHCVE-2026-86950EPSS 26.2%KEV