Summaryinfo

A vulnerability was found in Apple Safari up to 13.1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component WebKit. The manipulation results in type confusion. This vulnerability is known as CVE-2020-9948. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Detailsinfo

A vulnerability classified as critical has been found in Apple Safari up to 13.1.2 (Web Browser). Affected is some unknown processing of the component WebKit. The manipulation with an unknown input leads to a type confusion vulnerability. CWE is classifying the issue as CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was published 09/16/2020 by Brendan Draper with Zero Day Initiative as HT211845 as confirmed advisory (Website). The advisory is available at support.apple.com. This vulnerability is traded as CVE-2020-9948. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/08/2025). The advisory points out:

A type confusion issue was addressed with improved memory handling.

The vulnerability scanner Nessus provides a plugin with the ID 241427 (RHEL 7 : webkitgtk4 (RHSA-2025:10364)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 14.0 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (241427). Similar entries are available at VDB-161373, VDB-161371 and VDB-161372. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Web Browser

Vendor

• Apple

Name

• Safari

Version

• 13.1.0
• 13.1.1
• 13.1.2

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion