Apple WebKit Bugs Behind the Coruna iOS Exploit Kit

What to do

1. Pull an OS version report from MDM and flag iPhones and iPads below iOS 17.3 (on 17), 16.7.15 (on 16) or 15.8.7 (on 15).
2. Update flagged devices to the newest build they support: iOS 26.7.1 or 27.0.1, 18.7.10, 16.7.16 or 15.8.8.
3. Check Macs with sw_vers -productVersion and the Safari version; flag Sonoma below 14.3, Ventura below 13.6.4 and Monterey below 12.7.3 unless Safari is 17.3 or later.
4. On Linux, update WebKitGTK or WPE WebKit below 2.42.5, and ask appliance vendors which WPE version they ship.
5. Turn on Lockdown Mode on any device that cannot update; Google says Coruna quits when it detects Lockdown Mode or private browsing.

How to check if you are affected or compromised

• Search DNS and proxy logs for Coruna delivery domains Google published, such as cdn[.]uacounter[.]com, goodcryptocurrency[.]top, ai-scorepredict[.]com and pepeairdrop01[.]com.
• Search for Google's PLASMAGRID C2 domains, such as vvri8ocl4t3k8n6[.]xyz and rlau616jc7a7f7i[.]xyz.
• If an old device reached any indicator, get a mobile forensics review and treat crypto wallets, seed phrases stored as text or QR images, and credentials as exposed.

What happened#

On March 3, 2026, Google's Threat Intelligence Group published its Coruna report: an iOS kit with 23 exploits for iOS 13 through 17.2.1. Its first stage is a WebKit exploit that runs when Safari loads a page. Three of those map to KEV entries: "buffout" (CVE-2021-30952, iOS 13 to 15.1.1), "terrorbird" (CVE-2023-43000, 16.2 to 16.5.1) and "cassowary" (CVE-2024-23222, 16.6 to 17.2.1). A fourth, CVE-2022-48503, has its own brief. Google warns some mappings may be revised.

Google first saw Coruna in February 2025 with a surveillance vendor's customer, and found CVE-2024-23222 on a device running iOS 17.2. In summer 2025, UNC6353, a suspected Russian espionage group, loaded the kit from compromised Ukrainian sites; Google collected CVE-2024-23222, CVE-2022-48503 and CVE-2023-43000 there. UNC6691, a financially motivated group operating from China, then used it in broad campaigns on fake finance and crypto sites. The final payload hunts for crypto wallets and seed phrases.

The bugs are old. CVE-2021-30952, an integer overflow reported through Tianfu Cup, was fixed in iOS 15.2 on December 13, 2021. CVE-2023-43000, a use-after-free, was fixed in iOS 16.6, Ventura 13.5 and Safari 16.6 on July 24, 2023, but Apple published the CVE only in November 2025. Apple fixed CVE-2024-23222, a type confusion it said "may have been exploited," in iOS 17.3, iOS 16.7.5 and macOS Sonoma 14.3 on January 22, 2024. CISA listed it the next day. It added CVE-2021-30952 and CVE-2023-43000 on March 5, 2026, with Coruna's kernel bug CVE-2023-41974. CISA's ADP scores all three 8.8 (NVD, NVD, NVD).

Who is affected#

Taken together, devices are exposed below iOS 17.3, 16.7.5 or 15.8.7, macOS Sonoma 14.3, Ventura 13.6.4 or Monterey 12.7.3 without Safari 17.3, tvOS 17.3 and visionOS 1.0.2. Old hardware is the catch. On March 11, 2026, Apple shipped iOS 15.8.7 for the iPhone 6s, 7 and first-generation SE, with CVE-2023-43000 and CVE-2024-23222 fixes each "associated with the Coruna exploit." iOS 16.7.15 added a related WebKit fix, CVE-2023-43010, for the iPhone 8 and X. WebKitGTK and WPE WebKit were also affected: before 2.34.4 (WSA-2022-0001), 2.42.0 (WSA-2025-0008) and 2.42.5 (WSA-2024-0001).

Do you really need to act?#

Usually not. Apple's current builds carry every fix. The exposure is an iPhone or iPad that stopped updating, plus iOS 15 hardware that missed 15.8.7. Coruna changed the stakes: UNC6691 served it to any iOS visitor, and Help Net Security notes the shift from surveillance to crypto theft.

What to do now#

1. Pull an MDM version report. Flag iOS 17 below 17.3, iOS 16 below 16.7.15 (Apple's last Coruna backport) and iOS 15 below 15.8.7.
2. Update to the newest build each device supports: iOS 26.7.1, 27.0.1, 18.7.10, 16.7.16 or 15.8.8.
3. On Macs, run sw_vers -productVersion and defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString.
4. On Linux, run dpkg -l | grep -i webkit or rpm -qa | grep -i webkit and update below 2.42.5.
5. Turn on Lockdown Mode where updating is impossible. Google says Coruna quits in Lockdown Mode or private browsing.

How to tell if you were hit#

Google lists delivery URLs and PLASMAGRID C2 domains. Search DNS and proxy logs: grep -E "uacounter\.com|goodcryptocurrency\.top|ai-scorepredict\.com|vvri8ocl4t3k8n6\.xyz|rlau616jc7a7f7i\.xyz" dns.log. Google says the loader injects into powerd under the identifier com.apple.assistd. If an old device hit an indicator, get a forensic review. Google says the payload scans text and QR-code images for seed phrases, so move crypto funds from a clean device.

Timeline#

• Dec 13, 2021 — iOS 15.2 fixes CVE-2021-30952.
• Jul 24, 2023 — iOS 16.6 fixes CVE-2023-43000, unannounced.
• Jan 22, 2024 — iOS 17.3 and 16.7.5 fix zero-day CVE-2024-23222; KEV follows on Jan 23.
• Nov 5, 2025 — CVE-2023-43000 is published.
• Mar 3, 2026 — Google publishes the Coruna report.
• Mar 5, 2026 — CISA adds CVE-2021-30952 and CVE-2023-43000 to KEV.
• Mar 11, 2026 — Apple ships iOS 15.8.7 and 16.7.15 Coruna backports.

Vulnerability records

• CVE-2021-30952 · KEV 2026-03-05 · An integer overflow was addressed with improved input validation.
• CVE-2023-43000 · KEV 2026-03-05 · A use-after-free issue was addressed with improved memory management.
• CVE-2024-23222 · KEV 2024-01-23 · A type confusion issue was addressed with improved checks.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Apple — About the security content of iOS 15.2 and iPadOS 15.2 support.apple.com
2. Apple — About the security content of iOS 16.6 and iPadOS 16.6 support.apple.com
3. Apple — About the security content of iOS 17.3 and iPadOS 17.3 support.apple.com
4. Apple — About the security content of iOS 16.7.5 and iPadOS 16.7.5 support.apple.com
5. Apple — About the security content of iOS 15.8.7 and iPadOS 15.8.7 support.apple.com
6. Apple — About the security content of iOS 16.7.15 and iPadOS 16.7.15 support.apple.com
7. Apple — Apple security releases support.apple.com
8. CVE record — CVE-2021-30952 cve.org
9. CVE record — CVE-2023-43000 cve.org
10. CVE record — CVE-2024-23222 cve.org
11. NVD — CVE-2021-30952 nvd.nist.gov
12. NVD — CVE-2023-43000 nvd.nist.gov
13. NVD — CVE-2024-23222 nvd.nist.gov
14. CISA — Known Exploited Vulnerabilities: CVE-2021-30952 cisa.gov
15. CISA — Known Exploited Vulnerabilities: CVE-2023-43000 cisa.gov
16. CISA — Known Exploited Vulnerabilities: CVE-2024-23222 cisa.gov
17. WebKitGTK — Security Advisory WSA-2022-0001 webkitgtk.org
18. WebKitGTK — Security Advisory WSA-2024-0001 webkitgtk.org
19. WebKitGTK — Security Advisory WSA-2025-0008 webkitgtk.org
20. Google Threat Intelligence Group — Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit cloud.google.com

Coverage and analysis

1. Help Net Security — Coruna: Spy-grade iOS exploit kit powering financial crime helpnetsecurity.com