Loading vulnerability…
CVE-2023-28205 is a WebKit use-after-free vulnerability affecting Apple Safari, iOS, iPadOS, and macOS. The flaw stems from improper memory management in WebKit and can be triggered when a target processes maliciously crafted web content. Apple indicated the issue was addressed through improved memory management. Successful exploitation can result in arbitrary code execution in the context of the affected component. Apple also stated that the vulnerability may have been exploited in the wild.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a proof-of-concept (POC) exploit for CVE-2023-28205, a use-after-free vulnerability in Apple WebKit. The repository contains 13 files, including JavaScript modules for memory manipulation, an HTML file (index.html) that serves as the exploit entry point, a main exploit script (poc.js), and a simple Python HTTP server (server.py) for local hosting. The exploit is triggered by visiting the HTML page in a vulnerable browser, which loads poc.js and executes the exploit logic. The JavaScript code manipulates Map and Date objects to trigger a use-after-free condition, then attempts to demonstrate memory reuse or browser crash, indicating exploitability. The code is modular, with supporting files for low-level memory operations, heap spraying, and debugging. No weaponized payload is included; the POC demonstrates the vulnerability and memory corruption potential. The exploit targets Apple WebKit on macOS and iOS platforms. The server.py script allows easy local hosting of the exploit files for testing.
This repository is a proof-of-concept (POC) exploit for CVE-2023-28205, a use-after-free vulnerability in Apple WebKit. The structure includes a Python HTTP server (server.py) to serve the exploit files, an HTML file (index.html) that loads the exploit, and a JavaScript POC (poc.js) that triggers the vulnerability by manipulating Map and Date objects to induce a use-after-free condition. The 'module/' directory contains supporting JavaScript modules for memory manipulation and exploitation primitives, suggesting the code is designed for advanced browser exploitation research. The exploit is intended to be run in a browser environment, targeting vulnerable versions of WebKit (Safari on macOS/iOS). No weaponized payload is included; the POC demonstrates the bug and can cause a browser crash or potentially arbitrary code execution if further developed.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A WebKit use-after-free vulnerability that could allow arbitrary code execution via maliciously crafted web content.
An Apple zero-day vulnerability patched in April 2023 (no additional details provided in the content).
An Apple zero-day vulnerability reported as exploited and patched in April 2023 (no additional technical details provided in the content).
Apple zero-day vulnerability where maliciously crafted web content could allow arbitrary code execution on the device without user approval.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.