CVE-2018-4233

HIGH EXPLOITED

Safari < 11.1.1 - Remote Code Execution via WebKit Memory Corruption

Title source: llm

Exploitation Summary

CVE-2018-4233 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Metasploit, saelo.

AI-analyzed exploit summary This Metasploit module exploits a type confusion vulnerability in WebKit's JavaScript Proxy object (CVE-2018-4233) and a logic error in libxpc (CVE-2018-4404) to achieve remote code execution on macOS versions 10.12 to 10.13.3.

Description

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotemacos

https://www.exploit-db.com/exploits/45998

View Code ZIP pw:eip

This Metasploit module exploits a type confusion vulnerability in WebKit's JavaScript Proxy object (CVE-2018-4233) and a logic error in libxpc (CVE-2018-4404) to achieve remote code execution on macOS versions 10.12 to 10.13.3.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Complex

Reliability

Reliable

Target: Apple Safari on macOS 10.12 to 10.13.3

No auth needed

Prerequisites: Victim must visit a malicious webpage · Target macOS version must be vulnerable

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

nomisec WORKING POC 180 stars

by saelo · client-side

https://github.com/saelo/cve-2018-4233

View Code ZIP pw:eip

This is a working exploit for CVE-2018-4233, a JIT compiler bug in WebKit. It achieves arbitrary memory read/write via addrof and fakeobj primitives, then escapes the Safari sandbox using a multi-stage payload.