CVE-2021-1879: Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability

Vulnerability summary

CVE-2021-1879 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in Apple iOS, iPadOS, and watchOS. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 7.08% chance of exploitation in the next 30 days, higher than 94.1% of scored vulnerabilities.

Timeline

1. 02-04-2021
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVApple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability
3. 17-11-2021
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited..

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.