Loading story…
Researchers detailed CVE-2022-32792, a Safari/WebKit JavaScriptCore vulnerability in the B3ReduceStrength optimization phase that mishandled integer range analysis for sign-extension operations such as SExt8, SExt16, and SExt32. The flaw, disclosed after Manfred Paul exploited it at Pwn2Own, caused pre-patch code to treat sign extension as effectively preserving the original range, which could wrongly remove overflow and underflow checks from CheckAdd, CheckSub, and CheckMul operations in JIT-compiled code.
Apple fixed the issue in WebKit by adding IntRange::sExt and updating rangeFor so sign extension is modeled correctly. The published walkthrough showed how the bug could be turned from an Int32 underflow into a bounds-check bypass and out-of-bounds array access, then into corruption of adjacent array metadata; by overlapping double and object arrays, the exploit produced addrof and fakeobj primitives that could be extended to arbitrary read/write and eventual code execution in Safari/WebKit.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
STAR Labs published a detailed analysis of CVE-2022-32792, explaining the root cause in JavaScriptCore's B3ReduceStrength phase and showing how the bug could be turned into out-of-bounds access and object corruption primitives. The write-up included proof-of-concept details demonstrating a path toward arbitrary read/write and eventual code execution in Safari/WebKit.
Apple fixed CVE-2022-32792 in WebKit by adding IntRange::sExt and updating rangeFor so SExt8, SExt16, and SExt32 operations are modeled correctly during optimization. The patch addressed unsafe elimination of overflow and underflow checks that could lead to out-of-bounds writes.
Manfred Paul successfully exploited the WebKit JavaScriptCore vulnerability later tracked as CVE-2022-32792 at Pwn2Own, demonstrating the bug in a real-world contest setting. The exploit exposed a flaw in B3ReduceStrength's handling of sign-extension range analysis.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two Safari WebKit exploitation paths that turned renderer memory corruption into reliable arbitrary read/write primitives on macOS and iOS. Google Project Zero showed how `CVE-2020-9802`, a JavaScriptCore JIT flaw, could be exploited starting from `addrof` and `fakeobj` primitives, then bypass WebKit mitigations including **StructureID randomization**, the **Gigacage**, and **PACCage**. The write-up demonstrated leaking a valid StructureID with a fake `JSArray` and then abusing `TypedArray` handling in the DFG JIT to escape the Gigacage and gain fast, stable arbitrary memory access. Theori separately analyzed a Safari **AudioWorklet** type confusion introduced in Safari 14.1, where WebKit failed to verify that a returned JavaScript object was a `JSAudioWorkletProcessor`. That missing type check allowed attacker-controlled objects to be confused and used to corrupt `JSArray` butterfly pointers, again yielding `addrof`, `fakeobj`, and arbitrary read/write capabilities. The exploit reportedly worked on iOS 14.6 and macOS 11.4 even after the source patch was public, highlighting patch-gap risk and reinforcing concerns that existing WebKit hardening measures could still be bypassed in practice.
Jul 24, 2026
Google Project Zero published several vulnerability reports covering memory-safety and type-confusion flaws in major JavaScript engines, including Mozilla **SpiderMonkey**, Google **V8**, and Apple **JavaScriptCore**. The issues described unsafe conditions such as leaked `JS_OPTIMIZED_OUT` values, V8 map migration that failed to respect element kinds and caused type confusion, incorrect garbage-collection assumptions in JavaScriptCore's DFG pipeline, unsafe `ObjectGroup` handling in SpiderMonkey's IonMonkey, and a JavaScriptCore `CodeBlock` use-after-free tied to dangling watchpoints. Project Zero also disclosed a **macOS sandbox escape** involving type confusion in `coreaudiod` and the **CoreAudio** framework, extending the set of reports beyond browser engines into operating-system security boundaries. Taken together, the disclosures highlight recurring exploitation risks from **type confusion**, **use-after-free**, and JIT/compiler logic errors that can enable unsafe code execution, memory corruption, or sandbox bypass across widely deployed platforms.
Jul 12, 2026
Apple released security updates for **Safari, iOS, iPadOS, and macOS** to fix more than 30 vulnerabilities, including the high-severity Safari/WebKit flaw **`CVE-2026-43715`**, a remotely exploitable use-after-free bug triggered by maliciously crafted web content. Apple said the issue could lead to memory corruption and addressed it with improved memory management in **Safari 26.5.2**, **iOS 26.5.2**, **iPadOS 26.5.2**, and **macOS Tahoe 26.5.2**; the flaw carries a **CVSS 8.8** rating. The broader patch set also remediates additional WebKit and kernel vulnerabilities that could cause crashes, sensitive data exposure, sandbox escape, and kernel memory corruption. Apple said none of the flaws were known to be exploited in the wild, but it is accelerating patch delivery because AI-assisted research may shorten the gap between vulnerability discovery and weaponization; several of the WebKit bugs were identified with help from **OpenAI Codex Security** and researchers using **Anthropic Claude**.
Jul 2, 2026