---
title: "Apple WebKit Bugs Behind the Coruna iOS Exploit Kit"
url: https://erroneo.us/security/briefs/apple-webkit-coruna-cve-2021-30952-2023-43000-2024-23222/
description: "Three WebKit RCE stages of the Coruna iOS kit, fixed from iOS 15.2 to 17.3, with iOS 15 fixes only in March 2026. Find iPhones and Macs left behind."
type: security-brief
section: "Security Digest"
date_published: 2021-12-13
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2021-30952", "CVE-2023-43000", "CVE-2024-23222"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Apple WebKit Bugs Behind the Coruna iOS Exploit Kit

**Verdict: Check exposure.** All three are fixed on current builds, but Coruna moved from spyware customers to mass scam sites and iOS 15 devices got two of these fixes only in March 2026, so find any device still behind.

- **Who must act:** Anyone with iPhones or iPads below iOS 17.3 (on 17), 16.7.5 (on 16) or 15.8.7 (on 15), Macs below Sonoma 14.3, Ventura 13.6.4 or Monterey 12.7.3 without Safari 17.3, or WebKitGTK or WPE WebKit below 2.42.5.
- **Who can relax:** Devices on current Apple releases (iOS 26.7.1 or 27.x, 18.7.10, 16.7.16 or 15.8.8) and Macs on Sonoma 14.3 or later, Ventura 13.6.4 or later or Safari 17.3 or later, which carry all three fixes.
- **Affected:** iOS and iPadOS 17 before 17.3 (CVE-2024-23222); iOS and iPadOS 16 before 16.6 (CVE-2023-43000) and before 16.7.5 (CVE-2024-23222); iOS and iPadOS 15 before 15.2 (CVE-2021-30952) and before 15.8.7 (CVE-2023-43000, CVE-2024-23222); macOS Sonoma before 14.3, Ventura before 13.6.4, Monterey before 12.7.3, and Safari before 17.3 (CVE-2024-23222); macOS Ventura before 13.5 and Safari before 16.6 (CVE-2023-43000); Monterey before 12.1 and Safari before 15.2 (CVE-2021-30952); tvOS before 17.3, visionOS before 1.0.2 and watchOS before 8.3; WebKitGTK and WPE WebKit before 2.42.5
- **Fixed:** iOS and iPadOS 17.3 (Jan 22, 2024); iOS and iPadOS 16.7.5 (Jan 22, 2024); iOS and iPadOS 15.8.7 (Mar 11, 2026); macOS Sonoma 14.3, Ventura 13.6.4, Monterey 12.7.3 and Safari 17.3; tvOS 17.3, visionOS 1.0.2 and watchOS 8.3; WebKitGTK and WPE WebKit 2.42.5
- **CVEs:** CVE-2021-30952, CVE-2023-43000, CVE-2024-23222
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Pull an OS version report from MDM and flag iPhones and iPads below iOS 17.3 (on 17), 16.7.15 (on 16) or 15.8.7 (on 15).
2. Update flagged devices to the newest build they support: iOS 26.7.1 or 27.0.1, 18.7.10, 16.7.16 or 15.8.8.
3. Check Macs with sw_vers -productVersion and the Safari version; flag Sonoma below 14.3, Ventura below 13.6.4 and Monterey below 12.7.3 unless Safari is 17.3 or later.
4. On Linux, update WebKitGTK or WPE WebKit below 2.42.5, and ask appliance vendors which WPE version they ship.
5. Turn on Lockdown Mode on any device that cannot update; Google says Coruna quits when it detects Lockdown Mode or private browsing.

### How to check if you are affected

- Search DNS and proxy logs for Coruna delivery domains Google published, such as cdn[.]uacounter[.]com, goodcryptocurrency[.]top, ai-scorepredict[.]com and pepeairdrop01[.]com.
- Search for Google's PLASMAGRID C2 domains, such as vvri8ocl4t3k8n6[.]xyz and rlau616jc7a7f7i[.]xyz.
- If an old device reached any indicator, get a mobile forensics review and treat crypto wallets, seed phrases stored as text or QR images, and credentials as exposed.

## What happened

On March 3, 2026, Google's Threat Intelligence Group published its [Coruna report](https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit): an iOS kit with 23 exploits for iOS 13 through 17.2.1. Its first stage is a WebKit exploit that runs when Safari loads a page. Three of those map to KEV entries: "buffout" ([CVE-2021-30952](https://www.cve.org/CVERecord?id=CVE-2021-30952), iOS 13 to 15.1.1), "terrorbird" ([CVE-2023-43000](https://www.cve.org/CVERecord?id=CVE-2023-43000), 16.2 to 16.5.1) and "cassowary" ([CVE-2024-23222](https://www.cve.org/CVERecord?id=CVE-2024-23222), 16.6 to 17.2.1). A fourth, CVE-2022-48503, has its own brief. Google warns some mappings may be revised.

Google first saw Coruna in February 2025 with a surveillance vendor's customer, and found CVE-2024-23222 on a device running iOS 17.2. In summer 2025, UNC6353, a suspected Russian espionage group, loaded the kit from compromised Ukrainian sites; Google collected CVE-2024-23222, CVE-2022-48503 and CVE-2023-43000 there. UNC6691, a financially motivated group operating from China, then used it in broad campaigns on fake finance and crypto sites. The final payload hunts for crypto wallets and seed phrases.

The bugs are old. CVE-2021-30952, an integer overflow reported through Tianfu Cup, was fixed in [iOS 15.2](https://support.apple.com/en-us/102875) on December 13, 2021. CVE-2023-43000, a use-after-free, was fixed in [iOS 16.6](https://support.apple.com/en-us/120338), Ventura 13.5 and Safari 16.6 on July 24, 2023, but Apple published the CVE only in November 2025. Apple fixed CVE-2024-23222, a type confusion it said "may have been exploited," in [iOS 17.3](https://support.apple.com/en-us/120304), [iOS 16.7.5](https://support.apple.com/en-us/120310) and macOS Sonoma 14.3 on January 22, 2024. CISA [listed it](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23222) the next day. It added [CVE-2021-30952](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30952) and [CVE-2023-43000](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000) on March 5, 2026, with Coruna's kernel bug CVE-2023-41974. CISA's ADP scores all three 8.8 ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-30952), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-43000), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-23222)).

## Who is affected

Taken together, devices are exposed below iOS 17.3, 16.7.5 or 15.8.7, macOS Sonoma 14.3, Ventura 13.6.4 or Monterey 12.7.3 without Safari 17.3, tvOS 17.3 and visionOS 1.0.2. Old hardware is the catch. On March 11, 2026, Apple shipped [iOS 15.8.7](https://support.apple.com/en-us/126632) for the iPhone 6s, 7 and first-generation SE, with CVE-2023-43000 and CVE-2024-23222 fixes each "associated with the Coruna exploit." [iOS 16.7.15](https://support.apple.com/en-us/126646) added a related WebKit fix, CVE-2023-43010, for the iPhone 8 and X. WebKitGTK and WPE WebKit were also affected: before 2.34.4 ([WSA-2022-0001](https://webkitgtk.org/security/WSA-2022-0001.html)), 2.42.0 ([WSA-2025-0008](https://webkitgtk.org/security/WSA-2025-0008.html)) and 2.42.5 ([WSA-2024-0001](https://webkitgtk.org/security/WSA-2024-0001.html)).

## Do you really need to act?

Usually not. [Apple's current builds](https://support.apple.com/en-us/100100) carry every fix. The exposure is an iPhone or iPad that stopped updating, plus iOS 15 hardware that missed 15.8.7. Coruna changed the stakes: UNC6691 served it to any iOS visitor, and [Help Net Security](https://www.helpnetsecurity.com/2026/03/03/coruna-ios-exploit-kit/) notes the shift from surveillance to crypto theft.

## What to do now

1. Pull an MDM version report. Flag iOS 17 below 17.3, iOS 16 below 16.7.15 (Apple's last Coruna backport) and iOS 15 below 15.8.7.
2. Update to the newest build each device supports: iOS 26.7.1, 27.0.1, 18.7.10, 16.7.16 or 15.8.8.
3. On Macs, run `sw_vers -productVersion` and `defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString`.
4. On Linux, run `dpkg -l | grep -i webkit` or `rpm -qa | grep -i webkit` and update below 2.42.5.
5. Turn on Lockdown Mode where updating is impossible. Google says Coruna quits in Lockdown Mode or private browsing.

## How to tell if you were hit

Google lists delivery URLs and PLASMAGRID C2 domains. Search DNS and proxy logs: `grep -E "uacounter\.com|goodcryptocurrency\.top|ai-scorepredict\.com|vvri8ocl4t3k8n6\.xyz|rlau616jc7a7f7i\.xyz" dns.log`. Google says the loader injects into `powerd` under the identifier `com.apple.assistd`. If an old device hit an indicator, get a forensic review. Google says the payload scans text and QR-code images for seed phrases, so move crypto funds from a clean device.

## Timeline

- Dec 13, 2021 — iOS 15.2 fixes CVE-2021-30952.
- Jul 24, 2023 — iOS 16.6 fixes CVE-2023-43000, unannounced.
- Jan 22, 2024 — iOS 17.3 and 16.7.5 fix zero-day CVE-2024-23222; KEV follows on Jan 23.
- Nov 5, 2025 — CVE-2023-43000 is published.
- Mar 3, 2026 — Google publishes the Coruna report.
- Mar 5, 2026 — CISA adds CVE-2021-30952 and CVE-2023-43000 to KEV.
- Mar 11, 2026 — Apple ships iOS 15.8.7 and 16.7.15 Coruna backports.

## Sources

1. [Apple — About the security content of iOS 15.2 and iPadOS 15.2](https://support.apple.com/en-us/102875)
2. [Apple — About the security content of iOS 16.6 and iPadOS 16.6](https://support.apple.com/en-us/120338)
3. [Apple — About the security content of iOS 17.3 and iPadOS 17.3](https://support.apple.com/en-us/120304)
4. [Apple — About the security content of iOS 16.7.5 and iPadOS 16.7.5](https://support.apple.com/en-us/120310)
5. [Apple — About the security content of iOS 15.8.7 and iPadOS 15.8.7](https://support.apple.com/en-us/126632)
6. [Apple — About the security content of iOS 16.7.15 and iPadOS 16.7.15](https://support.apple.com/en-us/126646)
7. [Apple — Apple security releases](https://support.apple.com/en-us/100100)
8. [CVE record — CVE-2021-30952](https://www.cve.org/CVERecord?id=CVE-2021-30952)
9. [CVE record — CVE-2023-43000](https://www.cve.org/CVERecord?id=CVE-2023-43000)
10. [CVE record — CVE-2024-23222](https://www.cve.org/CVERecord?id=CVE-2024-23222)
11. [NVD — CVE-2021-30952](https://nvd.nist.gov/vuln/detail/CVE-2021-30952)
12. [NVD — CVE-2023-43000](https://nvd.nist.gov/vuln/detail/CVE-2023-43000)
13. [NVD — CVE-2024-23222](https://nvd.nist.gov/vuln/detail/CVE-2024-23222)
14. [CISA — Known Exploited Vulnerabilities: CVE-2021-30952](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30952)
15. [CISA — Known Exploited Vulnerabilities: CVE-2023-43000](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43000)
16. [CISA — Known Exploited Vulnerabilities: CVE-2024-23222](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23222)
17. [WebKitGTK — Security Advisory WSA-2022-0001](https://webkitgtk.org/security/WSA-2022-0001.html)
18. [WebKitGTK — Security Advisory WSA-2024-0001](https://webkitgtk.org/security/WSA-2024-0001.html)
19. [WebKitGTK — Security Advisory WSA-2025-0008](https://webkitgtk.org/security/WSA-2025-0008.html)
20. [Google Threat Intelligence Group — Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit](https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit)
21. [Help Net Security — Coruna: Spy-grade iOS exploit kit powering financial crime](https://www.helpnetsecurity.com/2026/03/03/coruna-ios-exploit-kit/)

---
Source page: https://erroneo.us/security/briefs/apple-webkit-coruna-cve-2021-30952-2023-43000-2024-23222/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt