What is CVE-2021-30952?
CVE-2021-30952 is a WebKit vulnerability in Apple platforms caused by an integer overflow that is addressed through improved input validation. In Apple’s security advisories, the issue is described under WebKit and the reported impact is that processing maliciously crafted web content may lead to arbitrary code execution.
Because WebKit is the browser engine behind Safari and is widely used for rendering web content across Apple platforms, this issue can be triggered by hostile pages (or embedded web content) when a user views them.
Apple credits the report to @18f and @jq0904 (DBAPP Security’s weibin lab) via Tianfu Cup in multiple platform advisories.
What is Affected By CVE-2021-30952?
CVE-2021-30952 affects Apple software components that include vulnerable WebKit builds prior to the listed fixed versions. Apple’s advisories indicate fixes shipped in December 2021 updates across multiple product lines, with later entry updates noted in 2022.
Affected (update to the fixed version or later):
-
iOS / iPadOS: versions before iOS 15.2 / iPadOS 15.2
-
macOS Monterey: versions before macOS Monterey 12.1
-
Safari (macOS Big Sur & Catalina): versions before Safari 15.2
-
watchOS: versions before watchOS 8.3
-
tvOS: versions before tvOS 15.2
Also relevant in non-Apple distributions of WebKit:
-
WebKitGTK / WPE WebKit: versions before 2.34.4 (downstream advisory for the same underlying WebKit issue).
Mitigation and Remediation For CVE-2021-30952
The primary remediation for CVE-2021-30952 is to apply Apple updates that include the fixed WebKit builds. Apple explicitly lists the issue as fixed in iOS/iPadOS 15.2, macOS Monterey 12.1, Safari 15.2, watchOS 8.3, and tvOS 15.2.
If you manage fleets, prioritize patching devices that routinely browse untrusted content or use embedded web views, since the trigger condition is maliciously crafted web content.
Recommended actions:
-
Update Apple OS/software to at least: iOS/iPadOS 15.2, macOS 12.1, Safari 15.2, watchOS 8.3, tvOS 15.2 (or any newer supported release).
-
In enterprise environments, use MDM enforcement to ensure timely OS/Safari updates and reduce long-lived exposure windows (especially for managed iPhones/iPads).
-
Apply compensating controls where immediate patching isn’t possible:
-
Restrict access to high-risk/untrusted browsing (e.g., tighten web filtering/proxy policies).
-
Limit exposure from embedded web content in apps where feasible (policy-based controls, least-privilege app sets).
-
-
For Linux/embedded environments using WebKit ports, update WebKitGTK / WPE WebKit to 2.34.4 or later per the project advisory.
Impact of Successful Exploitation of CVE-2021-30952
Successful exploitation of CVE-2021-30952 can result in arbitrary code execution through WebKit when a target processes malicious web content. Apple’s stated impact is arbitrary code execution from crafted content, which typically means an attacker may be able to run code in the context of the browser or the app component using WebKit.
Real-world outcomes depend on platform protections (sandboxing, system hardening) and whether the attacker can chain additional bugs, but code execution in a web-rendering engine is still a meaningful foothold for follow-on abuse.
Potential impacts include:
-
Execution of attacker-controlled code within the WebKit/Safari rendering context.
-
Data exposure or manipulation within the affected app/session (e.g., content accessible to that process).
-
Further compromise if combined with additional vulnerabilities (for example, to escape containment boundaries), though such chaining is not implied by Apple’s advisory text.
Proof of Concept for CVE-2021-30952
Public, vendor-endorsed exploit-style PoCs for CVE-2021-30952 are not commonly published, and sharing weaponized WebKit payloads is unsafe. What is publicly documented is the vulnerability class (integer overflow) and the security impact in WebKit, as well as downstream confirmation in the WebKitGTK/WPE advisory.
The minimal example below is an educational demonstration of how an integer overflow/wraparound can occur in size calculations—representative of the bug class Apple states was fixed via improved input validation.
// Educational example: detecting integer overflow in a size calculation.
// This is NOT a WebKit PoC—it’s a safe illustration of the vulnerability class.
#include <stdint.h>
#include <stdbool.h>
#include <stdio.h>
static bool add_u32_overflow(uint32_t a, uint32_t b, uint32_t *out) {
uint32_t r = a + b;
*out = r;
return r < a; // overflow if wraparound occurred
}
int main(void) {
uint32_t len = 0xFFFFFFF0; // attacker-controlled length (example)
uint32_t extra = 0x40; // additional bytes (example)
uint32_t total = 0;
if (add_u32_overflow(len, extra, &total)) {
puts(“Overflow detected: reject input (expected mitigation).”);
return 0;
}
printf(“No overflow: total=%u\n”, total);
return 0;
}
If you need a research trail for deeper technical validation, start from Apple’s platform advisories (fixed versions and component = WebKit) and the WebKitGTK/WPE advisory (affected versions before 2.34.4), then correlate with patch-level diffs in the relevant upstream/downstream trees rather than relying on unverified “exploit” repos.