WebKit OOB write → kernel LPE

## description

Out-of-bounds write in WebKit allows arbitrary code execution in the renderer; chained with an AppleAVD kernel bug for kernel R/W.

## impact

Renderer RCE chained to kernel compromise. Used in targeted attacks.

## mitigation

iOS 15.6.1+.

## proof of concept

// OOB write primitive
let buf = new Uint8Array(0x100);
for (let i=0;i<0x1000;i++) buf[i]=0x41; // OOB

## downloads

## references

• Apple HT213412
• NVD entry