Apple on Monday rolled out an urgent software update to its iOS and iPadOS mobile operating systems and warned that zero-day exploitation has already been detected.
For the second time since adopting the “rapid security responses” process to address zero-day attacks, Apple pushed iOS 16.5.1 (a) and iPadOS 16.5.1 (a) to devices globally after an anonymous researcher disclosed the underlying vulnerability.
A barebones advisory from Cupertino said the security defect exists in WebKit, the browser engine used by Safari, Mail, AppStore and many other apps on iOS- and macOS-powered devices.
“Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited,” the company said. “The issue was addressed with improved checks.”
The vulnerability has been tagged as CVE-2023-37450.
So far in 2023, there have been 41 publicly documented cases of zero-day attacks with more than one-fifth (22 percent) affecting software code on Apple devices.
Related: Problems Installing Apple’s First iOS Rapid Security Response Patch
Related: Apple Ships Urgent iOS Patch for Exploited Zero-Days
Related: Apple Fixes Exploited Zero-Day With iOS 16.1 Patch
Related: Apple Says WebKit Zero-Day Hitting iOS, macOS Devices