CVE-2022-22620VulnerabilityPublished 02/11/2022Updated 10/24/2026

CVE-2022-22620: Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability

Affects Apple iOS, iPadOS, and macOSSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 02/11/2022
KEV deadline: 02/25/2022
EPSS: 16.3% chance of exploitation in 30 days – higher than 96% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2022-22620 (opens in a new tab)

Description

CVE-2022-22620 is a use-after-free vulnerability in Apple iOS, iPadOS, and macOS WebKit that allows code execution when processing malicious web content. It affects HTML parsers using WebKit, including Apple Safari and other products relying on WebKit. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

Summary

Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability (CWE-416) that can lead to arbitrary code execution when processing specially crafted web content. This impacts HTML parsers that utilize WebKit, such as Apple Safari and other third-party products using WebKit for HTML processing. The vulnerability has been observed to be exploited in the wild, indicating active threat usage. No explicit patch or remediation details are provided in the available data.

Impact

Successful exploitation of this use-after-free vulnerability can result in arbitrary code execution on affected devices running iOS, iPadOS, or macOS. This could allow attackers to execute malicious code within the context of the affected browser or application using WebKit, potentially compromising the device.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official patches are confirmed and applied, users should exercise caution when visiting untrusted websites and consider limiting exposure to potentially malicious web content.

Weaknesses

CWE-416Use After Free (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:11:29 UTC

Weaknesses

References

Related threats