CVE-2022-22620

HIGH KEV

Safari < 15.3 - Use-After-Free via Malicious Web Content

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-22620 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 11, 2022. EIP tracks 3 public exploits from researchers including springsec, kmeps4, bb33bb.

AI-analyzed exploit summary This repository contains a README describing CVE-2022-22620, a use-after-free vulnerability in Safari (WebKit) leading to an infoleak exploit. It references the original PoC by Google Project Zero and provides testing details for webkitgtk-2.34.3.

Description

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Exploits (3)

nomisec WRITEUP 7 stars
by springsec · client-side
https://github.com/springsec/CVE-2022-22620

This repository contains a README describing CVE-2022-22620, a use-after-free vulnerability in Safari (WebKit) leading to an infoleak exploit. It references the original PoC by Google Project Zero and provides testing details for webkitgtk-2.34.3.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Theoretical
Target: Safari (WebKit) webkitgtk-2.34.3
No auth needed
Prerequisites: Access to a vulnerable version of Safari/WebKit
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP 2 stars
by kmeps4 · client-side
https://github.com/kmeps4/CVE-2022-22620

This repository contains a README file referencing CVE-2022-22620, a use-after-free vulnerability in Safari. It links to Google Project Zero's analysis but does not include exploit code or technical details.

Classification
Writeup 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: Safari (version not specified)
No auth needed
Prerequisites: Vulnerable version of Safari
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by bb33bb · poc
https://github.com/bb33bb/dkjiayu.github.io

The repository contains only a README.md file with a title and a CVE reference, lacking any actual exploit code or technical details. No proof-of-concept or exploit logic is present.

Classification
Stub 10%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213091
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213092
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT213093
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202208-39

Scores

CVSS v3 8.8
EPSS 0.1634
EPSS Percentile 96.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2022-02-11
VulnCheck KEV 2022-02-10
InTheWild.io 2022-02-10
ENISA EUVD EUVD-2022-27765
CWE
CWE-416
Status published
Products (4)
apple/ipados < 15.3.1
apple/iphone_os < 15.3.1
apple/macos 12.0.0 - 12.2.1
apple/safari < 15.3
Published Mar 18, 2022
KEV Added Feb 11, 2022
Tracked Since Feb 18, 2026