CVE-2023-43010 – Critical WebKit Memory Corruption in iOS (Coruna Exploit Kit)
Key Takeaways
- Critical memory‑corruption bug in Apple’s WebKit (CVE‑2023‑43010) enables remote code execution.
- Actively exploited by the nation‑state‑linked Coruna exploit kit.
- Affects legacy iPhone models (6s, 7, SE 1st gen, 8, X) and older iPad models (Air 2, mini 4, etc.).
- Apple back‑ported a patch to iOS 15.8.7 and iOS 16.7.15 on 12 Mar 2026.
- Immediate action: update all vulnerable devices or enforce updates via MDM.
Overview
On March 12, 2026, Apple released security updates for older iOS versions to address a Critical WebKit memory‑corruption vulnerability (CVE‑2023‑43010). The flaw is leveraged by the Coruna exploit kit, which has been observed delivering remote code execution on legacy iPhone and iPad devices that cannot upgrade to the latest iOS releases. Apple back‑ported the fix to iOS 15.8.7 and iOS 16.7.15, covering a range of devices still in use across enterprises and consumer markets. For real‑time threat signals and a timeline of exploitation activity, see the VulnSocial CVE page.
Technical Details
CVE‑2023‑43010 is a memory‑corruption bug in the WebKit rendering engine. A crafted web page can trigger an out‑of‑bounds write that corrupts heap memory, allowing an attacker to execute arbitrary code in the context of Safari or any WebKit‑based application. The Coruna exploit kit packages this vulnerability with additional modules to gain persistent system‑level control. Active exploitation was reported on the day of disclosure, with multiple incidents logged on 12 Mar 2026.
Severity & Impact
Apple classifies the issue as Critical. The NVD entry assigns a high CVSS v3.1 base score (see NVD for details). Successful exploitation yields full device compromise, enabling data theft, credential harvesting, and installation of persistent backdoors. Because the bug resides in the core web rendering engine, any app that renders web content is at risk.
Affected Products
| Product | Affected Versions | Patched Versions |
|---|---|---|
| iPhone | 6s, 7, SE (1st gen), 8, X – iOS 15.x / 16.x | iOS 15.8.7, iOS 16.7.15 |
| iPad | Air 2, mini 4, 5th‑gen iPad – iOS 15.x / 16.x | iOS 15.8.7, iOS 16.7.15 |
For the complete list of affected devices and version ranges, see the CVE page.
Actionable Insights
- Deploy the patch to all vulnerable devices immediately.
- Enforce iOS 15.8.7 / iOS 16.7.15 (or later) via Mobile Device Management (MDM) policies.
- Inventory devices running iOS < 15.8.7 or iOS < 16.7.15 and prioritize their update.
- Monitor network traffic for anomalous WebKit activity and block known malicious domains used by the Coruna kit.
- Enable web‑content filtering or secure web gateways to intercept crafted exploit pages.
- Review crash logs for WebKit/Safari failures that may indicate exploitation attempts.
- Isolate legacy devices that cannot be updated until a suitable mitigation is applied.
Remediation & Mitigation
- Identify all iPhone and iPad devices running iOS versions older than 15.8.7 or 16.7.15.
- Apply the official Apple patch (iOS 15.8.7 or iOS 16.7.15) via OTA or iTunes.
- Enforce update compliance through MDM, setting the minimum OS version to the patched release.
- Deploy DNS‑ or URL‑based blocklists that include known Coruna command‑and‑control domains.
- Enable logging of WebKit crashes and forward events to a SIEM for correlation with exploit signatures.
- Conduct post‑patch validation to confirm the OS version and verify that malicious web pages no longer cause crashes.
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-43010
- https://postgoo.com/posts/69b3a45c59f33fe74ef78618?type=article
- https://t.me/s/it_news_for_all/8582
- https://thehackernews.com/2026/03/apple-issues-security-updates-for-older.html
- https://vulntracker.io/cves/CVE-2023-43010
- https://www.cve.org/CVERecord?id=CVE-2023-43010
- https://www.cveshield.com/dashboard
- https://www.securityweek.com/apple-updates-older-ios-versions-to-patch-coruna-exploits/
- https://x.com/kawn2020/status/2032045176185872401
- https://zoneantimalware.com/apple-correctif-3/
- https://vulnsocial.com
- https://vulnsocial.com/cve/CVE-2023-43010
Bottom line
The Critical WebKit memory‑corruption bug (CVE‑2023‑43010) is actively exploited by the Coruna kit. Apply the Apple patch (iOS 15.8.7 / iOS 16.7.15) immediately and enforce update compliance across legacy iOS devices.
#CVE202343010 #Critical #WebKit #iOS #AppleSecurity #Coruna #ExploitKit #Patch #Remediation