Researcher details a WebKit flaw, which can lead to a RCE exploit, that remains unpatched by Apple despite the availability of an open source fix for 3 weeks
WebKit bug that was fixed upstream has yet to find its way into Apple products. — Apple has yet to patch a security bug found … Source: Theori .
Context & Ripple Effects
Theori's disclosure lands in familiar territory: back in 2018, Microsoft shipped a Safari-class spoofing fix weeks before Apple did, and Apple's WebKit patch record since has been a mix of fast emergency releases and long tail gaps. The difference this time is that the fix is public in open source — anyone can read the patch while iPhone and Mac owners wait on Apple's release train.
First-order effects
- Every Safari user and every app rendering web content through WebKit on iOS and macOS is exposed to a remote code execution path reachable from a crafted page until Apple ships its own build of the three-week-old fix.
- Because the patch is public upstream, attackers can diff the open-source change to reverse-engineer the vulnerability even without Theori publishing exploit details themselves.
Second-order effects
- Apple faces a credibility problem it has met before with emergency zero-day rollouts like the Google-reported actively exploited WebKit RCE it fixed in iOS 16.1.2 — each visible lag pushes security teams to treat Apple's patch cadence as unreliable rather than merely slower.
- Enterprises running fleets of Macs inherit the same exposure pattern seen when Apple fixed Monterey vulnerabilities but left some supported older versions unpatched — defenders must decide whether to force OS upgrades or accept known-risk devices.
Third-order effects
- If the pattern holds — upstream WebKit fixes landing well before Apple product updates — the practical security boundary shifts from 'patch your device' to 'watch the open-source tree', inviting scrutiny of how quickly closed-device vendors absorb public fixes into shipping software.
- Repeated lags strengthen the case for decoupled security-update mechanisms on Apple platforms, since the current model ties every WebKit fix to a full OS release cycle.
The trend: WebKit security is becoming a race between public open-source fixes and Apple's release pipeline, with disclosure researchers increasingly exposing the gap between the two.