CVE-2023-43010
A memory-handling flaw in WebKit could let malicious web content corrupt memory.
Open Settings > General > Software Update on each family iPhone and iPad and install the latest version offered; older devices need at least iOS/iPadOS 15.8.7 or 16.7.15 on those branches. If you suspect compromise, ask your security adviser to investigate and help reset affected account passwords from a trusted device.
- Affects
- Apple iPhone and iPad (iOS and iPadOS)
- Severity
- Critical
- Fixed in
- iOS 15.8.7 and iPadOS 15.8.7: Coruna backports for devices limited to version 15.
iOS 16.7.15 and iPadOS 16.7.15: Coruna backport for devices limited to version 16.
iOS 17.4 and iPadOS 17.4: Apple's fixes for the last two listed vulnerabilities, CVE-2024-23225 and CVE-2024-23296; earlier updates fixed the other listed CVEs. - Being used in attacks
- Not known to be
- Made public
- 3 Mar 2026
Part of: Coruna iPhone exploit kit used for surveillance and cryptocurrency theft
Google disclosed Coruna on 3 March 2026 after tracking its use during 2025 by surveillance, suspected Russian espionage and financially motivated operators. Its 23 exploits formed five attack chains targeting iPhones running iOS 13.0–17.2.1. Malicious websites could compromise vulnerable phones; financial-theft payloads searched for wallet recovery phrases and banking information. iVerify independently reported cryptocurrency theft and collection of photographs and emails. Apple had already fixed vulnerabilities in newer software, then extended Coruna protection to older devices through iOS/iPadOS 15.8.7 and 16.7.15 on 11 March. Apple subsequently confirmed that fully updated devices were protected. One version discrepancy remains: Google maps CVE-2024-23296 to iOS 17.5, while Apple lists its fix in 17.4; the versions below follow Apple. The reviewed sources do not establish total victims, money stolen or recovered, or that all campaigns have ended.
Fixed in the same update
- CVE-2020-27932Type confusion in Apple's kernel
- CVE-2020-27950Kernel memory disclosure in Apple devices
- CVE-2021-30952Integer overflow in Apple WebKit
- CVE-2022-48503Code execution in Apple's JavaScriptCore
- CVE-2023-32409WebKit web-content sandbox escape
- CVE-2023-32434Integer overflow in Apple's kernel
- CVE-2023-38606Sensitive kernel-state modification in Apple devices
- CVE-2023-41974Use-after-free in the iOS and iPadOS kernel
- CVE-2023-43000Use-after-free in Apple WebKit
- CVE-2024-23222Type confusion in Apple WebKit
- CVE-2024-23225Kernel memory-protection bypass in Apple devices
- CVE-2024-23296RTKit kernel memory-protection bypass
Sources
- About the security content of iOS 15.8.7 and iPadOS 15.8.7Apple · 11 Mar 2026
- About the security content of iOS 16.7.15 and iPadOS 16.7.15Apple · 11 Mar 2026
- Update iOS to protect your iPhone from web attacksApple · 14 Apr 2026
- Coruna: The Mysterious Journey of a Powerful iOS Exploit KitGoogle Threat Intelligence Group · 3 Mar 2026
- iVerify Details First Known Mass iOS AttackiVerify · 3 Mar 2026
- Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1The Hacker News · 3 Mar 2026
- About the security content of iOS 17.4 and iPadOS 17.4Apple · 5 Mar 2024
- About the security content of iOS 14.2 and iPadOS 14.2Apple · 5 Nov 2020