CVE-2021-30809

HIGH

Safari < 15.0 - Use-After-Free via Malicious Web Content

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-30809. PoCs published by seregonwar.

AI-analyzed exploit summary This repository contains a functional crash PoC for CVE-2021-30809, a use-after-free vulnerability in WebKit. The exploit leverages crafted JavaScript to trigger a crash in WebKit's internationalization/date-time formatting code paths, with a focus on deterministic crash reproduction for research and testing purposes.

Description

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary code execution.

Exploits (1)

nomisec WORKING POC 2 stars

by seregonwar · poc

https://github.com/seregonwar/CVE-2021-30809-OOM

View Code ZIP pw:eip

This repository contains a functional crash PoC for CVE-2021-30809, a use-after-free vulnerability in WebKit. The exploit leverages crafted JavaScript to trigger a crash in WebKit's internationalization/date-time formatting code paths, with a focus on deterministic crash reproduction for research and testing purposes.

Classification

Working Poc 95%

Attack Type

Dos

Complexity

Moderate

Reliability

Reliable

Target: WebKit (e.g., WebKitGTK, WPE WebKit, PlayStation 4 Browser)

No auth needed

Prerequisites: A vulnerable version of WebKit (e.g., WebKitGTK/WPE WebKit before 2.32.4) · A device or browser running the vulnerable WebKit engine (e.g., PlayStation 4 Browser)

MITRE ATT&CK

T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 19, 2026 Full analysis →