CVE-2021-30952 - PatchNow

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: USER_INTERACTION

CVE Published: 2021-08-24

Added to CISA KEV: 2026-03-05 1654 DAYS BETWEEN CVE AND KEV

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review browser history, check for unauthorized access, verify system integrity on affected Apple devices
Update all Apple devices to patched versions: iOS/iPadOS 15.2+, macOS 12.1+, watchOS 8.3+, Safari 15.2+
Monitor for suspicious web browsing activity and unusual process execution
Implement web filtering to block known malicious domains
Educate users about avoiding suspicious websites and links

CVE-2021-30952 is an integer overflow vulnerability in Apple’s WebKit engine that allows for arbitrary code execution ^[1] ^[2].

While initially identified in 2021, the vulnerability has seen renewed attention due to its inclusion in active exploit kits.

Active Exploitation: As of March 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2021-30952 to its Known Exploited Vulnerabilities (KEV) catalog following its use in the "Coruna" iOS exploit kit ^[3].
Threat Actor Usage: It has been utilized as part of exploit chains within the Coruna kit, which targets iOS devices ^[3].

Exploitation Vector: The vulnerability is triggered by processing maliciously crafted web content ^[1].
User Interaction: Successful exploitation requires the victim to voluntarily interact with the attack mechanism (e.g., visiting a malicious website) ^[1].
Access Level: It is a remote exploitation vector, as it relies on web content processing.

Successful Exploitation: An attacker can achieve arbitrary code execution within the context of the browser or the application component utilizing WebKit ^[2].
Real-world Outcome: While the impact is limited by platform protections like sandboxing, it serves as a critical foothold for attackers to chain additional vulnerabilities for further system compromise ^[2].

The vulnerability was addressed by Apple through improved input validation.

Users are strongly advised to update to the specified versions or later to mitigate the risk of exploitation.

NVD - CVE-2021-30952
CVE-2021-30952 Detail Description An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution. ... Victim m…
CVE-2021-30952: Apple WebKit Integer Overflow in iOS, macOS...
Apple’s stated impact is arbitrary code execution from crafted content, which typically means an attacker may be able to run code in the context of the browser or the app component using WebKit. Real-world outcomes depend on platform protections (sandboxing, system hardening) and whether the attacke…
Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting ...
Update The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on March 5, 2026, added CVE-2021-30952, CVE-2023-41974, and CVE-2023-43000 to its Known Exploited Vulnerabilities (KEV) catalog following the abuse of the flaws in the Coruna exploit kit.

🟢 CVE-2021-30952