PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7650 Apple CVE debrief

CVE-2016-7650 is an Apple browser issue affecting Safari Reader. According to the supplied NVD record, a crafted website can be used to conduct a UXSS attack on iOS devices before 10.2 and Safari before 10.0.2. NVD rates the issue medium severity (CVSS 4.7) and maps it to CWE-79.

Vendor
Apple
Product
CVE-2016-7650
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Apple users and administrators responsible for iOS and Safari patching, especially fleets that may still run iOS before 10.2 or Safari before 10.0.2.

Technical summary

The vulnerability is described as a UXSS issue in the Safari Reader component. NVD assigns CVSS 3.0 vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network reachability, required user interaction, changed scope, and limited confidentiality/integrity impact. The NVD weakness mapping is CWE-79.

Defensive priority

Patch affected Apple devices and browsers promptly if they remain within the vulnerable version ranges. This is not listed as a KEV item in the supplied corpus, but it still merits attention because it affects a user-facing browser component and requires only a crafted website to trigger.

Recommended defensive actions

  • Update iOS to 10.2 or later on affected devices.
  • Update Safari to 10.0.2 or later on affected systems.
  • Inventory Apple devices and browsers to confirm none remain in the vulnerable ranges.
  • Apply the Apple security advisories referenced by NVD (HT207421 and HT207422) and verify the fixes are present.
  • Treat the issue as a browser-originated UXSS/CWE-79 class problem when reviewing web access risk and user exposure.

Evidence notes

The supplied CVE description states that iOS before 10.2 and Safari before 10.0.2 are affected and that Safari Reader can be abused via a crafted website for UXSS. The NVD metadata lists vulnerable CPE ranges for iPhone OS through 10.1.1 and Safari through 10.0.1, plus CVSS 3.0 vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N and CWE-79. NVD references Apple support advisories HT207421 and HT207422.

Official resources

Publicly disclosed in the CVE/NVD record on 2017-02-20; the supplied NVD entry was later modified on 2026-05-13. No KEV listing or ransomware-campaign use is indicated in the supplied corpus.