Security researcher finds a new CSS-based attack that crashes and restarts iPhones after malicious HTML is rendered, like when a user visits a malicious link
Vulnerability most likely affects any iOS and macOS app that uses the WebKit rendering engine to display web pages. Apple is investigating.
Context & Ripple Effects
This is at least the second time a rendering-level bug has knocked iPhones over en masse: a [[a:867170|bug in iOS 9.3 crashed iPhones and iPads whenever links were opened in Safari and other apps]], and this new CSS-based attack follows the same shape — hostile HTML, delivered by a link, taking down the device rather than just the page.
What makes this one broader is the blast radius named in the report: because every iOS and macOS app that displays web content uses WebKit, the vulnerability is not confined to Safari. That concentration has defined Apple's security story since — from Confiant's later finding that a WebKit bug let over a billion malicious ads redirect iOS and macOS users to hostile sites, to the [[a:985841|WebKit zero-day Apple patched in iOS 16.1.2 after Google reported it was being actively exploited]].
First-order effects
- Any iPhone user who taps a malicious link risks a crash-and-restart loop, and the exposure extends beyond Safari to every iOS and macOS app that renders web content through WebKit.
- Apple is investigating, which means there is no patch yet — users' only mitigation is link hygiene while the company works on a fix.
Second-order effects
- The delivery vector points straight at advertising: malicious HTML embedded in ads reaches users who never click anything suspicious, the exact path Confiant documented a year later when WebKit bugs were abused at scale through malicious ad code.
- Each high-profile WebKit disclosure raises pressure on Apple's patch cadence — a dynamic visible when researchers criticized Apple for leaving an RCE-capable WebKit flaw unpatched for weeks despite an open-source fix being available.
Third-order effects
- If the pattern holds, WebKit functions as a single point of failure for the entire Apple ecosystem: one renderer defect simultaneously exposes Safari, mail clients, in-app browsers, and every third-party app that displays HTML.
- The severity trajectory across these disclosures — from nuisance crashes in 2016 and 2018 toward secret-stealing attacks and actively exploited zero-days — suggests Apple's mandated shared engine will keep drawing both attacker investment and scrutiny of whether one browser engine should underpin a whole platform.
The trend: WebKit vulnerabilities are recurring on Apple platforms with escalating severity, turning the shared rendering engine into a persistent single point of failure that attackers escalate from denial-of-service pranks toward data theft and active exploitation.