Read the docs
TI-2021-01478 Aliases CVE-2021-1765GHSA-872w-fg9q-jgjx

Apple macOS: Maliciously crafted web content may violate iframe sandboxing policy

Priority LOW 32Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Maliciously crafted web content may violate iframe sandboxing policy.

Why it matters now

EPSS 0.01413 72nd percentileScored 2026-11-07
Fix Partial macOS (Apple): 11.2Red Hat: 2 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApplemacOSbefore 11.211.2Patch availableCNA
  • macOS VendorApple Affected before 11.2 Fixed in 11.2 Patch available CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*10.14 to before 10.14.6; 10.15 to before 10.15.7VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*10.14.6VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*10.14.6 security_update_2019-004VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*10.14.6 security_update_2019-005VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*10.14.6 security_update_2019-006VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*10.14.6 security_update_2019-007VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*10.14.6 security_update_2020-001VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*10.14.6 security_update_2020-002VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*10.14.6 security_update_2020-003VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*10.14.6 security_update_2020-004VulnerableApple
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions 10.14 to before 10.14.6; 10.15 to before 10.15.7 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:* Versions 10.14.6 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:* Versions 10.14.6 security_update_2019-004 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:* Versions 10.14.6 security_update_2019-005 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:* Versions 10.14.6 security_update_2019-006 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:* Versions 10.14.6 security_update_2019-007 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:* Versions 10.14.6 security_update_2020-001 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:* Versions 10.14.6 security_update_2020-002 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:* Versions 10.14.6 security_update_2020-003 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:* Versions 10.14.6 security_update_2020-004 Vulnerable ·Apple
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*10.14.6 security_update_2020-005VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*10.14.6 security_update_2020-006VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*10.14.6 security_update_2020-007VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*10.14.6 supplemental_updateVulnerableApple
cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*10.14.6 supplemental_update_2VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*10.15.7VulnerableApple
cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*10.15.7 supplemental_updateVulnerableApple
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*11.0 to before 11.2VulnerableApple
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*before 2.30.6VulnerableWebKitGTK
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:* Versions 10.14.6 security_update_2020-005 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:* Versions 10.14.6 security_update_2020-006 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:* Versions 10.14.6 security_update_2020-007 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:* Versions 10.14.6 supplemental_update Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:* Versions 10.14.6 supplemental_update_2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:* Versions 10.15.7 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:* Versions 10.15.7 supplemental_update Vulnerable ·Apple
  • cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions 11.0 to before 11.2 Vulnerable ·Apple
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:* Versions before 2.30.6 Vulnerable ·WebKitGTK

Remediation

  • Fix · CNA macOS (Apple) Fixed in 11.2

Red Hat 2 advisories

  • RHSA-2025:10364 Released 2025-07-07 · Red Hat rating Important
    webkitgtk4 security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) webkitgtk4-2.48.3-2.el7_9, webkitgtk4-devel-2.48.3-2.el7_9, webkitgtk4-jsc-2.48.3-2.el7_9 +1
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) webkitgtk4-devel-2.48.3-2.el7_9, webkitgtk4-doc-2.48.3-2.el7_9, webkitgtk4-jsc-devel-2.48.3-2.el7_9
  • RHSA-2021:4381 Released 2021-11-09 · Red Hat rating Moderate
    GNOME security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 8) LibRaw-devel-0.19.5-3.el8
    • Red Hat Enterprise Linux AppStream (v. 8) LibRaw-0.19.5-3.el8, gnome-autoar-0.2.3-2.el8, webkit2gtk3-2.32.3-2.el8 +3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apple macOS 11.2

    60 records Highest priority Priority CRITICAL 3 CRITICAL, 3 MEDIUM, 54 LOW

    Other records, highest priority first

    • TI-2021-01572 Apple iOS and iPadOS: A remote attacker may be able to cause arbitrary code executionPriority CRITICAL 100
    • TI-2021-01502 Type confusion in Apple iOS and iPadOSPriority CRITICAL 97
    • TI-2021-01495 Apple iOS and iPadOS: A malicious application may be able to elevate privilegesPriority CRITICAL 90
    Show all 60 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:4381
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2025:10364
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2025:10364
Not affected: 4 products
  • Red Hat CodeReady Linux Builder (v. 8)
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux BaseOS (v. 8)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-1765
  2. 2026-10-03 Alias added: GHSA-872w-fg9q-jgjx

References

Advisory 4

  • TI-2021-01573 Apple iOS and iPadOS: A remote attacker may be able to cause arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-01572 Apple iOS and iPadOS: A remote attacker may be able to cause arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-01607 sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-02117 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
See all 3209 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences