Attack list
Safari
25 attacked bugs
Attackers used Safari bugs this year.
What to do
Safari updates with your iPhone, iPad or Mac. Install the latest system update and restart.
Attackers keep using these against anything that hasn't updated. Updating closes them.
BugConfirmed in attacks
- Apple bug: use-after-free webkitCVE-2025-43529Dec 15, 2025
- Apple bug: webkit out-of-bounds writeCVE-2025-24201Mar 13, 2025
- Apple bug: webkit type confusionCVE-2024-23222Jan 23, 2024
- Apple bug: webkit memory corruptionCVE-2023-42917Dec 4, 2023
- Apple bug: webkit out-of-bounds readCVE-2023-42916Dec 4, 2023
- Apple bug: webkit code executionCVE-2023-41993Sep 25, 2023
- Apple bug: webkit code executionCVE-2023-37450Jul 13, 2023
- Apple bug: webkit memory corruptionCVE-2023-32435Jun 23, 2023
- Apple bug: webkit type confusionCVE-2023-32439Jun 23, 2023
- Apple bug: webkit sandbox escapeCVE-2023-32409May 22, 2023
- Apple bug: webkit out-of-bounds readCVE-2023-28204May 22, 2023
- Apple bug: webkit use-after-freeCVE-2023-32373May 22, 2023
- Apple bug: webkit use-after-freeCVE-2023-28205Apr 10, 2023
- Apple bug: webkit type confusionCVE-2023-23529Feb 14, 2023
- Apple iOS bug: webkit memory corruptionCVE-2016-4657May 24, 2022
- Apple iOS, iPadOS, and macOS bug: ios, ipados, and macos webkit use-after-freeCVE-2022-22620Feb 11, 2022
- Apple iOS bug: webkit use-after-freeCVE-2021-30762Nov 3, 2021
- Apple iOS, iPadOS, and macOS bug: ios, ipados, and macos webkit remote code executionCVE-2021-1870Nov 3, 2021
- Apple iOS, iPadOS, and macOS bug: ios, ipados, and macos webkit remote code executionCVE-2021-1871Nov 3, 2021
- Apple iOS, iPadOS, and watchOS bug: ios, ipados, and watchos webkit cross-site scripting (XSS)CVE-2021-1879Nov 3, 2021
- Apple bug: webkit storage use-after-freeCVE-2021-30661Nov 3, 2021
- Apple iOS bug: webkit buffer overflowCVE-2021-30666Nov 3, 2021
- Apple bug: webkit memory corruptionCVE-2021-30665Nov 3, 2021
- Apple bug: webkit integer overflowCVE-2021-30663Nov 3, 2021
- Apple iOS bug: webkit memory corruptionCVE-2021-30761Nov 3, 2021
From the US government's list of bugs confirmed in real attacks (CISA KEV). Check everything you use.