---
title: "Apple WebKit CVE-2023-42916/42917: Spyware Zero-Day Pair"
url: https://erroneo.us/security/briefs/apple-webkit-cve-2023-42916-42917-pars-defense-zero-days/
description: "Two WebKit zero-days fixed in iOS 17.1.2 and Safari 17.1.2 in Nov 2023, later tied to spyware vendor PARS Defense. Find devices stuck on older builds."
type: security-brief
section: "Security Digest"
date_published: 2023-11-30
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-42916", "CVE-2023-42917"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Apple WebKit CVE-2023-42916/42917: Spyware Zero-Day Pair

**Verdict: Check exposure.** Patched in late 2023 and used by a commercial spyware vendor against iOS before 16.7.1; today the risk sits with Apple devices or WebKitGTK apps stuck on old builds, which are also open to later WebKit zero-days.

- **Who must act:** Owners of iPhones and iPads below iOS 17.1.2, 16.7.3 or 15.8.1, Macs with Safari below 17.1.2, and Linux apps using WebKitGTK or WPE WebKit below 2.42.3, especially for high-risk users.
- **Who can relax:** Fleets kept on current iOS, iPadOS and macOS releases; these bugs were fixed nearly three years ago and were tied to a spyware vendor whose tools target individuals.
- **Affected:** iOS and iPadOS before 17.1.2 (17.x), before 16.7.3 (16.x) and before 15.8.1 (15.x); macOS Sonoma before 14.1.2; Safari before 17.1.2 on macOS Monterey and Ventura; WebKitGTK and WPE WebKit before 2.42.3
- **Fixed:** iOS and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2 (Nov 30, 2023); iOS and iPadOS 16.7.3 (Dec 11, 2023); iOS and iPadOS 15.8.1 (Jan 22, 2024); WebKitGTK and WPE WebKit 2.42.3 (WSA-2023-0011, Dec 5, 2023)
- **CVEs:** CVE-2023-42916, CVE-2023-42917
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Pull an OS version report from MDM and flag iPhones and iPads below 17.1.2, 16.7.3 or 15.8.1 on their branch.
2. On Macs, check sw_vers -productVersion and the Safari version; flag Sonoma below 14.1.2 and Monterey or Ventura with Safari below 17.1.2.
3. Update every device to the newest build it supports, not just the 2023 fix, and enforce a minimum OS version in MDM.
4. On Linux, update WebKitGTK and WPE WebKit to 2.42.3 or later, including copies bundled inside apps.
5. Retire or block from corporate access any device too old for iOS 15.8.1; none of Apple's listed fixes cover it.

### How to check if you are affected

- Use MDM history to find devices that ran iOS before 16.7.1 in 2023, the versions Apple says were targeted.
- Run dpkg -l 'libwebkit2gtk*' or rpm -qa 'webkit2gtk*' on Linux hosts and flag versions below 2.42.3.
- No public indicators exist for the PARS Defense tooling as of Oct 23, 2026; for high-risk users' devices, get a professional forensic review.

## What happened

On November 30, 2023, Apple released iOS and iPadOS 17.1.2, macOS Sonoma 14.1.2 and Safari 17.1.2 to fix two WebKit bugs. Clément Lecigne of Google's Threat Analysis Group reported both. [Apple's iOS advisory](https://support.apple.com/en-us/120296) describes CVE-2023-42916 as an out-of-bounds read that "may disclose sensitive information." CVE-2023-42917 is a memory corruption bug, "addressed with improved locking," that may lead to arbitrary code execution. Both trigger when WebKit processes malicious web content. For each, Apple said it "is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1." Apple did not say how the two were used together.

CISA [added both](https://www.cisa.gov/news-events/alerts/2023/12/04/cisa-adds-two-known-exploited-vulnerabilities-catalog) to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42917) on December 4, 2023, with a December 25 deadline. The [entries](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42916) warn that the bugs could affect "non-Apple products which rely on WebKit for HTML processing." Apple backported the fixes to [iOS 16.7.3](https://support.apple.com/en-us/120301) on December 11, 2023 and to [iOS 15.8.1](https://support.apple.com/en-us/120308) on January 22, 2024. WebKitGTK and WPE WebKit fixed both in 2.42.3 ([WSA-2023-0011](https://webkitgtk.org/security/WSA-2023-0011.html)).

In February 2024, Google's [Buying Spying](https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors.pdf) report listed both CVEs under PARS Defense. [SecurityWeek](https://www.securityweek.com/google-links-over-60-zero-days-to-commercial-spyware-vendors/) describes PARS as a Turkish company. The report says such vendors sell governments tools that exploit consumer devices to install spyware. Victims, delivery method and indicators were still not disclosed as of Oct 23, 2026.

## Who is affected

According to Apple and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-42917), the affected versions are iOS and iPadOS before 17.1.2 on the 17 line, before 16.7.3 on 16, and before 15.8.1 on 15. Also affected are [macOS Sonoma](https://support.apple.com/en-us/120297) before 14.1.2, [Safari](https://support.apple.com/en-us/120298) before 17.1.2 on Monterey and Ventura, and WebKitGTK and WPE WebKit before 2.42.3. [Help Net Security](https://www.helpnetsecurity.com/2023/12/01/cve-2023-42916-cve-2023-42917/) noted that WebKit powers every browser on iOS and iPadOS, so switching browsers did not help. NVD scores CVE-2023-42917 at CVSS 3.1 8.8 and [CVE-2023-42916](https://nvd.nist.gov/vuln/detail/CVE-2023-42916) at 6.5.

## Do you really need to act?

Most fleets moved past these builds in late 2023, so the verdict is check exposure. The risk sits in three places: iPhones and iPads that stopped updating, Linux apps that bundle an old WebKitGTK, and devices of people a government might target. A device below these builds is also open to later WebKit zero-days in KEV. One is CVE-2024-23222, which [Google says](https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit) the Coruna exploit kit used against iOS 16.6 through 17.2.1. Another is CVE-2025-43529 from the DarkSword chain, which has its own brief. The goal is current builds, not just these two fixes.

## What to do now

1. Pull an OS version report from MDM and flag iPhones and iPads below 17.1.2, 16.7.3 or 15.8.1 on their branch.
2. On Macs, run `sw_vers -productVersion` and `defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString`. Flag Sonoma below 14.1.2, and Monterey or Ventura with Safari below 17.1.2.
3. Update every device to the newest build it supports, and enforce a minimum OS version in MDM.
4. On Linux, run `dpkg -l 'libwebkit2gtk*'` or `rpm -qa 'webkit2gtk*'` and update anything below 2.42.3.
5. Retire or block devices too old for iOS 15.8.1. None of Apple's listed fixes cover them.

## How to tell if you were hit

A version check only shows whether a device was exposed. Apple says exploitation targeted iOS before 16.7.1, so look in MDM history for devices that ran those versions in 2023. No public indicators exist for the PARS Defense tooling as of Oct 23, 2026. If a journalist, activist, executive or official used such a device, get a professional forensic review.

## Timeline

- Nov 30, 2023 — Apple ships iOS 17.1.2, macOS Sonoma 14.1.2 and Safari 17.1.2.
- Dec 4, 2023 — CISA adds both CVEs to KEV.
- Dec 5, 2023 — WebKitGTK and WPE WebKit publish WSA-2023-0011.
- Dec 11, 2023 — iOS and iPadOS 16.7.3 carry the fixes.
- Dec 25, 2023 — Federal remediation deadline.
- Jan 22, 2024 — iOS and iPadOS 15.8.1 carry the fixes.
- Feb 6, 2024 — SecurityWeek reports Google's attribution of both CVEs to PARS Defense.

## Sources

1. [Apple — About the security content of iOS 17.1.2 and iPadOS 17.1.2](https://support.apple.com/en-us/120296)
2. [Apple — About the security content of macOS Sonoma 14.1.2](https://support.apple.com/en-us/120297)
3. [Apple — About the security content of Safari 17.1.2](https://support.apple.com/en-us/120298)
4. [Apple — About the security content of iOS 16.7.3 and iPadOS 16.7.3](https://support.apple.com/en-us/120301)
5. [Apple — About the security content of iOS 15.8.1 and iPadOS 15.8.1](https://support.apple.com/en-us/120308)
6. [WebKitGTK and WPE WebKit — Security Advisory WSA-2023-0011](https://webkitgtk.org/security/WSA-2023-0011.html)
7. [CVE record — CVE-2023-42917](https://www.cve.org/CVERecord?id=CVE-2023-42917)
8. [CVE record — CVE-2023-42916](https://www.cve.org/CVERecord?id=CVE-2023-42916)
9. [NVD — CVE-2023-42917](https://nvd.nist.gov/vuln/detail/CVE-2023-42917)
10. [NVD — CVE-2023-42916](https://nvd.nist.gov/vuln/detail/CVE-2023-42916)
11. [CISA — Known Exploited Vulnerabilities: CVE-2023-42917](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42917)
12. [CISA — Known Exploited Vulnerabilities: CVE-2023-42916](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42916)
13. [CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Dec 4, 2023)](https://www.cisa.gov/news-events/alerts/2023/12/04/cisa-adds-two-known-exploited-vulnerabilities-catalog)
14. [Google — Buying Spying: Insights into Commercial Surveillance Vendors](https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors.pdf)
15. [Google Threat Intelligence Group — Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit](https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit)
16. [SecurityWeek — Google Links Over 60 Zero-Days to Commercial Spyware Vendors](https://www.securityweek.com/google-links-over-60-zero-days-to-commercial-spyware-vendors/)
17. [Help Net Security — Apple patches two zero-days used to target iOS users (CVE-2023-42916, CVE-2023-42917)](https://www.helpnetsecurity.com/2023/12/01/cve-2023-42916-cve-2023-42917/)

---
Source page: https://erroneo.us/security/briefs/apple-webkit-cve-2023-42916-42917-pars-defense-zero-days/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt