CVE-2023-37450: high-severity vulnerability in Apple Safari
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
A vulnerability in how Apple devices process web content could allow an attacker to run malicious code on your device just by visiting a compromised website. This is a serious flaw that Apple says has been actively exploited.
A memory corruption vulnerability in WebKit's web content processing engine allows arbitrary code execution with the privileges of the rendering process. The attack vector is remote and requires only user interaction (visiting a malicious webpage); no special access or authentication is needed. Apple confirmed active exploitation in the wild.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.