CVE-2021-1789

What is Apple WebKit?

WebKit is Apple's open-source web browser engine that renders all web content on iOS, iPadOS, macOS, watchOS, and tvOS — used by Safari and, on iOS/iPadOS, required for all browsers by App Store policy. WebKit processes complex, attacker-controlled HTML, CSS, JavaScript, and multimedia content. Type confusion vulnerabilities in WebKit's JavaScript engine (JavaScriptCore) occur when the engine accesses a JavaScript value as the wrong internal type — enabling attackers to craft JavaScript that confuses WebKit's type system, creating memory corruption primitives that lead to code execution in the WebKit renderer process.

Overview

CVE-2021-1789 is a type confusion vulnerability (CWE-843) in Apple WebKit that allows processing of maliciously crafted web content to lead to arbitrary code execution. Apple patched this in iOS 14.4 (January 26, 2021), alongside the kernel escalation zero-day CVE-2021-1782 — indicating CVE-2021-1789 was the WebKit renderer stage of a two-vulnerability iOS exploit chain. The simultaneous patching of browser and kernel zero-days is Apple's standard response to discovering a complete exploit chain in the wild. CISA added CVE-2021-1789 to the KEV catalog in May 2022 — fifteen months after the patch.

Affected Versions

Technical Details

• Root cause: Type confusion (CWE-843) in WebKit's JavaScript engine — the engine accesses a JavaScript object as an incorrect internal type; attacker-crafted JavaScript manipulates WebKit's type assumption about an object, creating an exploitable memory access at an incorrect offset
• Renderer code execution: Successful type confusion exploitation achieves arbitrary code execution in the WebKit renderer process — this is sandboxed on iOS, requiring a kernel escalation (CVE-2021-1782) for complete device compromise
• Zero-day chain: CVE-2021-1789 (WebKit type confusion, renderer RCE) + CVE-2021-1782 (XNU kernel race condition, SYSTEM escalation) = complete iOS exploit chain; Apple's simultaneous patching of both confirms they were used together in an active exploit
• Web content delivery: The exploit is delivered via a malicious web page, iMessage link preview, or any vector that causes WebKit to render attacker-controlled content — on iOS, this is universal since all browsers use WebKit
• Multiple platform scope: WebKit is shared across iOS, macOS, and watchOS — the type confusion exists in the JavaScriptCore engine common to all platforms, hence the "Multiple Products" classification

Discovery

Discovered as part of the same research or incident response that identified CVE-2021-1782 (XNU kernel race condition). Both were reported to Apple and patched simultaneously in January 2021, indicating they were observed being used together in a complete exploit chain. The May 2022 CISA KEV addition (fifteen months after patch) reflects continued exploitation against devices running iOS older than 14.4.

Exploitation Context

The January 2021 iOS 14.4 emergency release addressed a complete exploit chain discovered in the wild. CVE-2021-1789 (WebKit type confusion) serves as the initial code execution stage — converting a web page visit into sandboxed renderer code execution. This is then paired with CVE-2021-1782 (kernel LPE) to break out of the sandbox and gain persistent device access. This pattern is characteristic of commercial surveillance spyware delivery, where a single iMessage or web page visit triggers the complete chain invisibly. The fifteen-month gap between patch and CISA KEV addition reflects the pace of evidence accumulation from device forensics in high-priority investigations.

Remediation

1. Update iOS/iPadOS to 14.4 or later — any current iOS release contains the fix
2. Update macOS to Big Sur 11.2 or later; Safari to 14.0.3 or later
3. Enable automatic updates: Settings → General → Software Update → Automatic Updates (iOS)
4. The complete January 2021 exploit chain (CVE-2021-1789 + CVE-2021-1782) is fixed in the same iOS 14.4 update — a single update addresses both chain components
5. Lockdown Mode (iOS 16+) significantly restricts WebKit's attack surface by disabling link previews, web content features, and other surfaces that WebKit type confusion exploits commonly target