CVE-2018-4197

HIGH

Safari < 12 - Use-After-Free

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-4197. PoCs published by Google Security Research.

AI-analyzed exploit summary This is a proof-of-concept exploit for CVE-2018-4197, a use-after-free vulnerability in WebKit. The PoC triggers the vulnerability by manipulating DOM elements and selections, leading to a heap-use-after-free condition as confirmed by the AddressSanitizer log.

Description

A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · htmldosmultiple

https://www.exploit-db.com/exploits/45489

View Code ZIP pw:eip

This is a proof-of-concept exploit for CVE-2018-4197, a use-after-free vulnerability in WebKit. The PoC triggers the vulnerability by manipulating DOM elements and selections, leading to a heap-use-after-free condition as confirmed by the AddressSanitizer log.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: WebKit (latest source on OSX, confirmed with ASan build)

No auth needed

Prerequisites: Victim must visit a malicious webpage or open a crafted HTML file

MITRE ATT&CK

T1189 - Drive-by Compromise

devstral-2 · analyzed Feb 16, 2026 Full analysis →