Security News > 2022 > August > Apple patches double zero-day in browser and kernel – update now!
Apple just pushed out an emergency update for two zero-day bugs that are apparently actively being exploited.
There's a remote code execution hole dubbed CVE-20220-32893 in Apple's browser and HTML rendering software, by means of which a booby trapped web page can trick iPhones, iPads and Macs into running unauthorised and untrusted software code.
There's also a kernel code execution hole dubbed CVE-2022-32894, by which an attacker who has already gained a basic foothold on your Apple device by exploiting the abovementioned WebKit bug.
Could jump from controlling just a single app on your device to taking over the operating system kernel itself, thus acquiring the sort of "Admininstrative superpowers" normally reserved for Apple itself.
Apple hasn't said how these bugs were found, hasn't said where in the world they've been exploited, and hasn't said who's using them or for what purpose.
At the time of writing, Apple has published advisories for iPad OS 15 and iOS 15, which both get updated version numbers of 15.6.1, and for macOS Monterey 12, which gets an updated version number of 12.5.2.
News URL
Related news
- Apple fixes this year’s first actively exploited zero-day bug (source)
- Apple Patches Actively Exploited Zero-Day Affecting iPhones, Macs, and More (source)
- Apple zero-day vulnerability exploited to target iPhone users (CVE-2025-24085) (source)
- New Apple CPU side-channel attacks steal data from browsers (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-08-24 | CVE-2022-32894 | Out-of-bounds Write vulnerability in Apple products An out-of-bounds write issue was addressed with improved bounds checking. | 7.8 |