Loading story…
A chain of flaws in Apple’s iTunes Store and StoreKitUIService components allowed attacker-controlled content to execute inside a privileged iOS WebView and escalate to arbitrary code execution. A crafted itms:// or itms-ui URL could bypass hostname trust checks and load malicious secondary content, including data: URIs, producing client-side XSS in a trusted Apple app context; that issue was tracked as CVE-2021-1748. In the same environment, an overly permissive Objective-C WebScripting bridge exposed native methods to JavaScript, enabling disclosure of device and account data, local file access within the app container, app enumeration and launching, heap pointer leaks, and direct object deallocation from script.
See affected versions and whether adversaries are exploiting it.
15 events from the most recent confirmed update back to the earliest known activity.
On September 10, 2021, the third Mistuned article explained how fake Objective-C objects, NSInvocation gadgetry, and SLOP-style techniques were used to bypass PAC and reach shellcode execution on iOS 14.3.
On August 5, 2021, the second Mistuned article described the exposed WebScripting interface, heap disclosure, ASLR bypass, and dealloc-triggered use-after-free assigned CVE-2021-1864.
On August 4, 2021, the author published the first Mistuned article detailing the iTunes URL-scheme trust bypass, client-side XSS, and resulting privileged JavaScript access in Apple apps.
The January 16, 2021 article described how NSPredicate and NSExpression could be abused to invoke arbitrary Objective-C selectors and even reach program-counter control through NSInvocation gadgets.
At TianfuCup 2020, Ant Security and Qihoo 360 used different bug chains to achieve remote code execution with a userspace sandbox escape on an iPhone 11 running iOS 14.2.
A comment on December 12, 2019 marked Project Zero issue #1933 as Won't Fix and invalid because SLOP was considered an exploitation technique rather than a standalone vulnerability.
Jung Hoon Lee used the itmss:// scheme at Pwn2Own 2014 to open an arbitrary untrusted website in iTunes, leading to a sandbox escape. The issue was assigned CVE-2014-8840.
The vulnerable iTunes URL-handling code path later tied to CVE-2021-1748 existed as early as firmware Kirkwood7A341, which the write-up says was released in 2009.
The PAC-bypass write-up says iOS 14 initially signed isa pointers without verifying them, and that this gap remained until iOS 14.5, after which the SLOP approach was no longer viable in the same way.
The second Mistuned write-up states that the dealloc-triggered use-after-free reachable through the exposed WebScripting bridge was assigned CVE-2021-1864.
The first Mistuned write-up states that the URL-scheme trust bypass and client-side XSS affecting iTunes Store and StoreKitUIService was assigned CVE-2021-1748.
The write-up says iOS 14 changed the ABI to sign Objective-C isa pointers as a runtime protection, though verification remained incomplete at first.
A January 9, 2020 comment states that Project Zero made issue #1933 public alongside a blog post about remote iPhone exploitation, while noting the technique itself was not under a disclosure deadline.
Google Project Zero filed issue #1933 describing SeLector Oriented Programming (SLOP), an exploitation technique for bypassing PAC in iOS userspace using fake NSInvocation and NSArray objects.
The write-up says the use-after-free later assigned CVE-2021-1864 was introduced in iOS 6, when exposed SUScriptObject subclasses could be deallocated from JavaScript while references remained usable.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
codecolor.ist
Open sourcecodecolor.ist
Open sourcecodecolor.ist
Open sourcecodecolor.ist
Open sourcebugs.chromium.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple published multiple security release notes and update entries across its platforms, including iOS/iPadOS point releases (e.g., iOS/iPadOS 26.2.1, 18.7.4, 16.7.13, 15.8.6, 12.5.8) and watchOS 26.2.1, with Apple indicating **no published CVE entries** for several of the January 2026 point updates. Apple also refreshed or republished detailed historical security-content pages for older products, including macOS Big Sur 11.7.9 (listing fixes such as **CVE-2023-34425** kernel-privilege arbitrary code execution in Apple Neural Engine, **CVE-2023-32364** sandbox restriction bypass, and other privacy/logic issues), Xcode 14.1 (including multiple *git* issues such as **CVE-2022-29187**, **CVE-2022-39253**, **CVE-2022-39260**, plus an Xcode Server privilege issue **CVE-2022-42797**), and visionOS 2 for Apple Vision Pro (including issues like **CVE-2024-44126** heap corruption from crafted files, **CVE-2024-27876** arbitrary file write via archive unpacking race condition, and additional sandbox/data-access weaknesses). Separately, a vendor blog post warned that **critical WebKit vulnerabilities** could enable remote compromise of iOS devices via a malicious webpage (arbitrary code execution and potential credential/data theft), emphasizing patch latency as a key risk; however, the post does not clearly map its claims to specific Apple CVEs or to the “no published CVE entries” iOS/iPadOS point releases listed on Apple’s security releases page. A Reddit /r/netsec item about a **one-click** vulnerability in *IDIS Cloud Manager (ICM) Viewer* (triggered by clicking an untrusted link) is unrelated to Apple/WebKit and does not align with the Apple security-release content.
Jun 29, 2026
Apple patched **CVE-2016-4585**, a WebKit page-loading vulnerability in Safari that allowed remote attackers to inject arbitrary script or HTML through specially crafted HTTP redirections. The flaw affected **Safari before 9.1.2**, **iOS before 9.3.3**, and **tvOS before 9.2.2**, and stemmed from improper handling of redirect targets with malformed, non-numeric ports. Researchers showed Safari could send invalid `Host` headers after following such redirects, creating exploitable conditions in web applications that reflected the header into pages, scripts, links, forms, anchors, or subsequent `Location` values. The research also described an **origin confusion** condition in which pages reached through the malformed redirect could execute in a broken security context. When combined with an `iframe`, relative resources from a target page could be resolved against an attacker-controlled site, enabling cross-site scripting, spoofing, information theft, and possible content exfiltration or alteration under specific application conditions. Apple addressed the issue by tightening redirect URL validation so invalid redirection URLs trigger an error instead of being processed.
Aug 15, 2026
Researchers detailed two Safari WebKit exploitation paths that turned renderer memory corruption into reliable arbitrary read/write primitives on macOS and iOS. Google Project Zero showed how `CVE-2020-9802`, a JavaScriptCore JIT flaw, could be exploited starting from `addrof` and `fakeobj` primitives, then bypass WebKit mitigations including **StructureID randomization**, the **Gigacage**, and **PACCage**. The write-up demonstrated leaking a valid StructureID with a fake `JSArray` and then abusing `TypedArray` handling in the DFG JIT to escape the Gigacage and gain fast, stable arbitrary memory access. Theori separately analyzed a Safari **AudioWorklet** type confusion introduced in Safari 14.1, where WebKit failed to verify that a returned JavaScript object was a `JSAudioWorkletProcessor`. That missing type check allowed attacker-controlled objects to be confused and used to corrupt `JSArray` butterfly pointers, again yielding `addrof`, `fakeobj`, and arbitrary read/write capabilities. The exploit reportedly worked on iOS 14.6 and macOS 11.4 even after the source patch was public, highlighting patch-gap risk and reinforcing concerns that existing WebKit hardening measures could still be bypassed in practice.
Jul 24, 2026