In security updates released today, Apple fixed the tenth zero-day vulnerability used in attacks on iPhones or Macs since the start of the year.

The vulnerability was disclosed in security bulletins released today for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2 and macOS Ventura 13.1, with Apple warning that the flaw “may have been actively exploited” over previous versions.

The insect (CVE-2022-42856) is a type confusion issue in Apple’s Webkit web browser browsing engine.

The flaw was discovered by Clément Lecigne of Google’s Threat Analysis Group, allowing maliciously crafted web content to execute arbitrary code on a vulnerable device.

Executing arbitrary code could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions.

Apple addressed the zero-day vulnerability with improved state management.

Patch your iPhones, iPads and macOS Ventura

Although Apple disclosed that threat actors were actively exploiting the vulnerability, they have yet to provide details about the attacks.

However, since the vulnerability was discovered by Clément Lecigne of Google’s Threat Intelligence team, we’ll likely learn more about it in an upcoming blog post.

This delay in providing details is usually done to allow users to patch their devices before other threat actors analyze the patches and develop their own exploits.

Even though this zero-day flaw has probably been used in highly targeted attacks, it is still suggested to install today’s security updates as soon as possible.

This is the tenth zero-day set by Apple since the beginning of the year: