HighExploited in the wildCISA KEVPublic exploitVulnerability

CVE-2016-4657

WebKit Remote Code Execution in Apple iOS

Published Aug 25, 2016 · Updated 7 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS8.8High · v3.1

EPSS66.8%99th percentile

CISA KEVYesAdded May 24, 2022

In the wildActiveExploitation observed

Vendor: Apple

IdentifiersCVE-2016-4657CWE-119

CVE-2016-4657 is a memory-corruption vulnerability in WebKit affecting Apple iOS versions before 9.3.5. A remote attacker can trigger the flaw through a crafted website, resulting in arbitrary code execution or a denial of service. The vulnerability was used as the WebKit remote-code-execution component of the Trident iOS exploit chain, where it executed shellcode in Safari.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can allow remote execution of attacker-controlled code in the context of the affected WebKit/Safari browser or cause a denial of service through memory corruption. In the Trident exploit chain, it served as the initial browser-execution stage preceding additional exploits used for remote jailbreaking and Pegasus spyware installation.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by restricting access to untrusted websites and links, especially SMS-delivered lure links, and limiting Safari/WebKit use on at-risk devices. Mobile threat detection, network monitoring for known Pegasus-related infrastructure, and heightened protections for high-risk users can reduce risk, but these are compensating controls only; patching to iOS 9.3.5 or later is the effective mitigation.

Remediation

Patch, then assume compromise.

Update affected Apple iOS devices to iOS 9.3.5 or a later supported Apple security release. Apple released iOS 9.3.5 to patch the Trident vulnerabilities, including CVE-2016-4657.

Public exploits

Exploits

3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

View more in app →

webkit_trident.rbThis repository contains a single Metasploit module (modules/exploits/apple_ios/browser/webkit_trident.rb) that exploits a use-after-free (UAF) vulnerability in WebKit's JavaScriptCore library, as used in Apple iOS. The exploit targets CVE-2016-4655, CVE-2016-4656, and CVE-2016-4657, which were part of the 'Trident' exploit chain used by the Pegasus spyware. The module sets up an HTTP server that serves a malicious web page containing JavaScript to trigger the vulnerability in the target's browser. Depending on the requested URI, the server delivers different binaries (loader32, loader64, exploit64, payload32) to facilitate exploitation and payload delivery. The default payload is a Meterpreter reverse TCP shell for iOS (aarch64), providing the attacker with remote access to the device. The module is weaponized, allowing for customizable payloads and is suitable for operational use. The main attack vector is via a browser on a vulnerable iOS device visiting the attacker's server. The code is written in Ruby (Metasploit module) and includes embedded JavaScript for the browser exploit.Disclosed Aug 25, 2016 · Framework: metasploit · ruby · javascript · browser · networkWeaponized SwitcherooThis repository is a proof-of-concept (PoC) exploit for CVE-2016-4657, a WebKit vulnerability, targeting the Nintendo Switch's browser. The structure includes a minimal custom browser written in C++ (main.cpp) for Debian Linux, which simulates the Nintendo Switch user agent and loads an online exploit page. The main exploit logic is implemented in JavaScript (exploit/jailbreak.js) and is loaded via an HTML page (exploit/index.html). The exploit attempts to trigger a memory corruption bug in WebKit, resulting in a browser crash on the Nintendo Switch. The repository is intended for academic purposes and does not provide a persistent jailbreak or code execution, but demonstrates the feasibility of exploiting the vulnerability. The codebase includes supporting files for logging (exploit/logger.js) and styling (exploit/style.css). The only network endpoint directly targeted is the hosted exploit page (https://idan5x.github.io/Switcheroo/), which is loaded by the custom browser.iDaN5x · Disclosed Jun 2, 2017 · cpp · javascript · browserPoC webkit-vulnerabilityThis repository contains a proof-of-concept (PoC) exploit for CVE-2016-4657, a memory corruption vulnerability in the WebKit JavaScript engine affecting iOS 9.3 and the Nintendo Switch captive portal browser. The main exploit is implemented in 'attack.html', which uses advanced JavaScript techniques to manipulate memory and trigger the vulnerability. The exploit is designed to be run in a browser environment, specifically targeting the Nintendo Switch's captive portal (which uses a WebKit-based browser) or vulnerable versions of iOS Safari. The 'index.html' file serves as a landing page that detects the Nintendo Switch user agent and redirects to the exploit. The 'README.md' provides a brief overview and references a technical article for further reading. The 'tuto.md' is a detailed technical write-up on JavaScript engine exploitation, not directly part of the exploit but useful for understanding the context. The exploit demonstrates the vulnerability by corrupting array lengths and alerting the user, and may cause the browser to crash, showing exploitability. No weaponized payload is included; this is a research PoC.viai957 · Disclosed Nov 11, 2018 · javascript · html · browserPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

AppleIphone Osoperating_system

External references

References

MITRE CVEcve.org · CVE-2016-4657 NVDnvd.nist.gov/vuln/detail/CVE-2016-4657 MITRE CWE · CWE-119cwe.mitre.org Vendor Advisorysupport.apple.com/HT207107 Third Party Advisoryexploit-db.com/exploits/44836 Exploityoutube.com/watch?v=xkdPjbaLngE US Government Resourcecisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4657

Activity feed

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

citizenlabNews · Aug 24, 2016The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights DefenderA memory corruption vulnerability in WebKit (Safari browser engine) that allows execution of arbitrary code when a user visits a maliciously crafted website. Used as the first stage in the Trident exploit chain for remote iPhone jailbreaks.Read more ↗courtlistenerNews · May 26, 2026A vulnerability in operating systems or applications cited as an example of flaws exploited to enable Pegasus remote installation.Read more ↗

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidence1Every observed campaign linking this CVE to a named adversary.

Associated malware1Malware families riding this exploit, with evidence and IOCs.

Detection signatures2YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activityCommunity discussion across Reddit, Mastodon, and other social sources.