CVE-2016-4657

What Is Apple iOS WebKit?

WebKit is Apple's open-source browser engine powering Safari on iOS, macOS, and iPadOS. On iOS, WebKit is the only permitted browser rendering engine — all browsers on iOS (Chrome, Firefox, Edge) use WebKit under the hood. WebKit's role as the universal browser engine for iOS makes WebKit vulnerabilities applicable to every iOS web browser simultaneously. When WebKit is exploited, an attacker achieves code execution in the browser's renderer process — the first step toward a full device compromise through subsequent kernel exploitation.

Overview

CVE-2016-4657 is a WebKit memory corruption vulnerability that serves as the Stage 1 entry point of the Trident iOS zero-day exploit chain used by NSO Group's Pegasus spyware. When an iOS device visits a malicious URL in Safari (delivered via SMS, iMessage, or email), CVE-2016-4657 exploits a WebKit memory corruption flaw to achieve initial code execution in the WebKit renderer process. This execution is then used to chain to CVE-2016-4655 (kernel KASLR bypass) and CVE-2016-4656 (kernel LPE), resulting in a complete device jailbreak and Pegasus installation — all from a single URL tap. Discovered by Citizen Lab and Lookout Security. Patched in iOS 9.3.5 (August 25, 2016). CISA added CVE-2016-4657 to the KEV catalog in May 2022.

Affected Versions

Note: The WebKit vulnerability also affects macOS Safari and other platforms using the same WebKit version; iOS was the primary attack target for the Trident chain.

Technical Details

The Trident Exploit Chain

CVE-2016-4657 is Stage 1 of the Trident three-stage exploit chain:

Root Cause: WebKit Memory Corruption

CVE-2016-4657 is a memory corruption vulnerability (CWE-787) in WebKit's JavaScript engine (JavaScriptCore) or HTML/CSS processing pipeline. When iOS Safari loads a specially crafted web page, the WebKit renderer processes malformed content that triggers an out-of-bounds write — corrupting heap memory in a way that allows control flow hijacking.

Exploitation flow:

1. Attacker sends malicious SMS/iMessage link to the target's iPhone
2. Victim taps the link — Safari opens the URL
3. WebKit processes the malicious page — the crafted content triggers the memory corruption
4. Code executes in the WebKit renderer process — attacker's code runs in the Safari sandbox
5. Stage 2 and 3 execute — from within the renderer, CVE-2016-4655 and CVE-2016-4656 escalate to full kernel control

One-Tap Remote Jailbreak

The combination of CVE-2016-4657 (remote, single user interaction) with CVE-2016-4655 and CVE-2016-4656 (kernel escalation) produced a one-tap remote jailbreak — a complete iPhone compromise from a single tap on a malicious link, with no further interaction required. The victim saw a brief Safari loading screen followed by a crash/restart, with Pegasus silently installed in the background.

Attack Characteristics

Discovery

Discovered by Citizen Lab and Lookout Security through analysis of suspicious links sent to UAE activist Ahmed Mansoor on August 10, 2016. Citizen Lab's research identified the complete Trident chain and NSO Group's infrastructure. This was the first public documentation of a commercial iOS zero-day exploit chain used against civil society.

Exploitation Context

• Pegasus delivery mechanism: CVE-2016-4657 is the entry point through which NSO Group's Pegasus spyware was delivered — a single malicious URL could completely compromise an iPhone through an SMS or iMessage link without requiring any complex social engineering beyond the target tapping a link
• WebKit as universal iOS attack surface: Because all iOS browsers are required to use WebKit, WebKit vulnerabilities simultaneously affect Safari, Chrome for iOS, Firefox for iOS, and every other iOS browser — a single WebKit exploit provides universal iOS browser exploitation
• Nation-state targeting of civil society: Citizen Lab documented Pegasus use against journalists, lawyers, and human rights activists across the Middle East, Mexico, and elsewhere; CVE-2016-4657 was the trigger for these compromises
• iMessage zero-click evolution: Subsequent NSO Group/Pegasus exploit chains used iMessage zero-click vectors (CVE-2021-30860 "ForcedEntry") that removed even the single tap requirement; CVE-2016-4657 represents an earlier generation requiring one tap
• CISA KEV (2022): Added May 2022 alongside CVE-2016-4655 and CVE-2016-4656

Remediation

1. Update to iOS 9.3.5 or later — any current iOS release patches the Trident vulnerabilities. Update via Settings → General → Software Update.

2. Enable automatic iOS updates — configure iOS to automatically install security updates; mobile exploit chains are frequently patched with emergency updates and automatic updates minimize exposure windows.

3. Use Apple Lockdown Mode for high-risk individuals — Lockdown Mode (iOS 16+) disables many WebKit features that are required for advanced JavaScript exploitation, significantly raising the bar for WebKit-based exploit chains; recommended for journalists, activists, and others at elevated risk of commercial spyware targeting.

4. Be suspicious of unexpected links — Pegasus and similar spyware are delivered via unsolicited SMS, iMessage, or email links; high-risk individuals should avoid tapping links from unknown senders and use Lockdown Mode's automatic link handling.

5. Verify device integrity — use Amnesty International's Mobile Verification Toolkit (MVT) to check iOS backups for Pegasus indicators of compromise.