{"id":49425,"date":"2022-08-18T20:36:44","date_gmt":"2022-08-18T20:36:44","guid":{"rendered":"https:\/\/harchi90.com\/apple-patches-double-zero-day-in-browser-and-kernel-update-now-naked-security\/"},"modified":"2022-08-18T20:36:44","modified_gmt":"2022-08-18T20:36:44","slug":"apple-patches-double-zero-day-in-browser-and-kernel-update-now-naked-security","status":"publish","type":"post","link":"https:\/\/harchi90.com\/apple-patches-double-zero-day-in-browser-and-kernel-update-now-naked-security\/","title":{"rendered":"Apple patches double zero-day in browser and kernel \u2013 update now! \u2013 Naked Security"},"content":{"rendered":"
\n

Apple just pushed out an emergency update for two zero-day bugs that are apparently actively being exploited<\/em>.<\/p>\n

There’s a remote code execution hole (RCE) dubbed CVE-2022-32893<\/strong> in Apple’s HTML rendering software (WebKit), by means of which a booby trapped web page can trick iPhones, iPads and Macs into running unauthorised and untrusted software code.<\/p>\n

Simply put, a cybercriminal could implant malware on your device even if all you did was to view an otherwise innocent web page.<\/p>\n

Remember that WebKit is the part of Apple’s browser engine that sits underneath absolutely all web rendering software on Apple’s mobile devices.<\/p>\n

Macs can run versions of Chrome, Chromium, Edge, Firefox and other \u201cnon-Safari\u201d browsers with alternative HTML and JavaScript engines (Chromium, for example, uses Blink<\/em> and V8<\/em>; Firefox is based on gecko<\/em> and rhino<\/em>).<\/p>\n

But on iOS and iPadOS, Apple’s App Store rules insist that any software that offers any sort of web browsing functionality must be based on WebKit<\/em>including browsers such as Chrome, Firefox and Edge that don’t rely on Apple’s browsing code on any other plaforms where you might use them.<\/p>\n

Additionally, any Mac and iDevice apps with popup windows such as Help<\/em> or About<\/em> screens use HTML as their \u201cdisplay language\u201d \u2013 a programmatic convenience that is understandably popular with developers.<\/p>\n

Apps that do this almost certainly use Apple’s WebView<\/em> system functions, and WebView is based directly on top of WebKit<\/em>so it is therefore affected by any vulnerabilities in WebKit.<\/p>\n

the CVE-2022-32893<\/strong> vulnerability therefore potentially affects many more apps and system components than just Apple’s own Safari browser, so simply steering clear of Safari can’t be considered a workaround, even on Macs where non-WebKit browsers are allowed.<\/p>\n