Security researcher finds a new CSS-based attack that crashes and restarts iPhones after malicious HTML is rendered, like when a user visits a malicious link
Context & Ripple Effects
This is not the first time a rendering-engine quirk has taken iPhones down: a bug in iOS 9.3 crashed iPhones and iPads when opening links in Safari back in 2016, hitting old and new devices alike. The new finding extends that pattern from a version-specific defect to CSS itself — meaning any app or browser that renders attacker-supplied HTML is a delivery vehicle.
First-order effects
- iPhone users who tap a malicious link get an immediate device crash and restart, with no interaction beyond page render required.
- Apple's WebKit engineers become the named fix point: until a patch ships, every iOS device is exposed through ordinary web browsing.
Second-order effects
- Link-based delivery makes this cheap to weaponize at scale — the same WebKit surface later let malicious ad code redirect users to hostile sites in volume, showing how render-time bugs flow into malvertising pipelines.
- Enterprises and carriers face support load from unexplained restart loops, pushing demand for content filtering ahead of Apple's patch cadence.
Third-order effects
- Because WebKit is the shared rendering layer across iOS apps, each engine flaw is effectively a whole-device flaw — a structural concentration that recurs in later findings like the WebKit attack forcing browsers to divulge passwords and email content.
- The pattern pressures Apple's disclosure-and-patch process: researchers demonstrated willingness to publicize unpatched WebKit issues, as with the actively exploited WebKit zero-day Apple fixed in iOS 16.1.2, making render-engine security a standing reputational exposure rather than a one-off.
The trend: WebKit's role as the single rendering engine behind all iOS web content keeps turning stylesheet- and script-level bugs into device-wide attack surface, with researcher disclosures setting Apple's remediation clock.