Apple JavaScriptCore CVE-2022-48503: 2022 Bug Now in KEV

What to do

1. Pull an OS version report from MDM and flag any iPhone or iPad below iOS/iPadOS 15.6; update it to the newest release it supports (at least iOS 15.8.8).
2. Check Macs, Apple TVs and Apple Watches against the floors: Monterey 12.5 or Safari 15.6, tvOS 15.6, watchOS 8.7.
3. On Linux and embedded systems, check WebKitGTK or WPE WebKit and update anything below 2.38.0.
4. Retire or block from corporate access any device that cannot be updated.
5. If an old device must stay in use, turn on Lockdown Mode; Google says the Coruna kit quits when it detects Lockdown Mode.

How to check if you are affected or compromised

• Apple and CISA have published no indicators of compromise for this CVE.
• Search DNS and proxy logs for Coruna delivery domains published by Google, such as cdn[.]uacounter[.]com (the UNC6353 watering hole) and UNC6691 domains like goodcryptocurrency[.]top.
• If a device below iOS 15.6 reached one of those domains, get a forensic review and treat its accounts, wallets and stored credentials as exposed.

What happened#

On July 20, 2022, Apple shipped iOS 15.6, macOS Monterey 12.5, Safari 15.6, tvOS 15.6 and watchOS 8.7. Among the fixes was a JavaScriptCore bounds-check bug where "processing web content may lead to arbitrary code execution." Apple did not list it at the time. It added the entry to the iOS 15.6 notes on June 21, 2023 as CVE-2022-48503, crediting Dongzhuo Zhao (ADLab of Venustech) and ZhaoHai (Cyberpeace Tech). NVD scores it 8.8: network attack, no privileges, but the victim has to load the page.

CISA added it to the KEV catalog on October 20, 2025, with a November 10 deadline and a warning that affected products may be end-of-life. CISA has not said what exploitation prompted the listing.

The best public explanation came later. In its March 3, 2026 Coruna report, Google's Threat Intelligence Group says that in summer 2025 it found an exploit framework on cdn.uacounter[.]com, loaded as a hidden iframe on many compromised Ukrainian websites. It targeted selected iPhone users in one region. Google attributes it to UNC6353, a suspected Russian espionage group. Before the server went down, Google collected WebKit exploits including CVE-2022-48503, which the kit calls "jacurutu" and aims at iOS 15.2 through 15.5. The same kit, Coruna, later appeared on a large set of fake Chinese finance sites run by UNC6691, a financially motivated group, and was served to iOS visitors regardless of location. Help Net Security links the two, but whether Google's findings prompted CISA's listing is not disclosed as of Oct 23, 2026.

Who is affected#

Affected: iOS and iPadOS before 15.6, Monterey before 12.5, Safari before 15.6 on Big Sur and Catalina, tvOS before 15.6 and watchOS before 8.7. The bug also reached the Linux ports: WebKitGTK and WPE WebKit before 2.38.0 are affected (WSA-2023-0005). Every device that could run iOS 15 can take a far newer build today. The iPhone 6s and 7 top out at iOS 15.8.8 (May 2026), according to Apple's security releases page. Apple's March 2026 Coruna backports in iOS 15.8.7 covered other kit bugs; this one had been fixed since 15.6.

Do you really need to act?#

Usually not. A device must have skipped every update for over three years. Such devices exist, though: a drawer iPhone 7 used for testing, a kiosk iPad, an Apple TV in a meeting room, or an embedded Linux browser on WPE. Loading a web page is enough, and the exploit has moved from espionage to mass criminal use.

What to do now#

1. Pull an OS version report from MDM. Update any iPhone or iPad below 15.6 to the newest release it supports.
2. On Macs, check sw_vers -productVersion and the Safari version with defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString.
3. On Linux, run dpkg -l | grep -i webkit or rpm -qa | grep -i webkit and update anything below 2.38.0. Ask appliance vendors which WPE version they ship.
4. Retire or isolate devices that cannot be updated.
5. Where an old device must stay, turn on Lockdown Mode. Google says Coruna quits when it detects Lockdown Mode.

How to tell if you were hit#

Neither Apple nor CISA has published indicators for this CVE. Google lists Coruna delivery URLs, including cdn[.]uacounter[.]com/stat[.]html for UNC6353 and UNC6691 domains such as goodcryptocurrency[.]top and ai-scorepredict[.]com. Search DNS and proxy logs, for example grep -E "uacounter\.com|goodcryptocurrency\.top|ai-scorepredict\.com" dns.log. If an iPhone below iOS 15.6 reached one of these domains, get a forensic review. Treat its accounts, wallets and stored credentials as exposed.

Timeline#

• Jul 20, 2022 — Apple ships the fix in iOS 15.6 and sibling releases, without listing it.
• Jun 21, 2023 — Apple adds the CVE-2022-48503 entry to those notes.
• Jun 29, 2023 — WebKitGTK and WPE publish WSA-2023-0005.
• Oct 20, 2025 — CISA adds the CVE to KEV.
• Mar 3, 2026 — Google's Coruna report ties the bug to watering-hole and scam-site campaigns.

Vulnerability records

• CVE-2022-48503 · KEV 2025-10-20 · The issue was addressed with improved bounds checks.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Apple — About the security content of iOS 15.6 and iPadOS 15.6 support.apple.com
2. Apple — About the security content of macOS Monterey 12.5 support.apple.com
3. Apple — About the security content of Safari 15.6 support.apple.com
4. Apple — About the security content of tvOS 15.6 support.apple.com
5. Apple — About the security content of watchOS 8.7 support.apple.com
6. Apple — About the security content of iOS 15.8.7 and iPadOS 15.8.7 support.apple.com
7. Apple — Apple security releases support.apple.com
8. CVE record — CVE-2022-48503 cve.org
9. NVD — CVE-2022-48503 nvd.nist.gov
10. CISA — Known Exploited Vulnerabilities: CVE-2022-48503 cisa.gov
11. WebKitGTK — Security Advisory WSA-2023-0005 webkitgtk.org
12. Google Threat Intelligence Group — Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit cloud.google.com

Coverage and analysis

1. Help Net Security — Coruna: Spy-grade iOS exploit kit powering financial crime helpnetsecurity.com