PatchSiren cyber security CVE debrief
CVE-2017-2350 Apple CVE debrief
CVE-2017-2350 describes a WebKit flaw affecting Apple platforms that could let a remote attacker use a crafted website to bypass the Same Origin Policy and read sensitive information. Apple listed affected versions of iOS before 10.2.1, Safari before 10.0.3, and tvOS before 10.1.1. NVD also maps WebKitGTK+ before 2.16.3 to this issue. The impact is confidentiality-focused and requires user interaction through web content.
- Vendor
- Apple
- Product
- Safari
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-02-20
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-02-20
- Advisory updated
- 2026-05-13
Who should care
Organizations and individuals running affected Apple devices or browsers, especially where users regularly browse untrusted websites. Security teams should prioritize managed fleets of iPhone/iPad, Safari on Apple systems, and tvOS deployments, as well as environments that track WebKit-based components.
Technical summary
The issue is a Same Origin Policy bypass in WebKit. In practical terms, a maliciously crafted website could cause the browser engine to expose information that should have remained isolated to a different origin. The NVD CVSS vector reflects network delivery, low attack complexity, no privileges required, and user interaction, with confidentiality impact only (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
Defensive priority
Medium. The vulnerability does not indicate integrity or availability impact, but it can expose sensitive web-origin data and affects widely deployed client software. Remediation should be applied promptly on any systems still running affected versions.
Recommended defensive actions
- Update affected Apple devices to iOS 10.2.1 or later.
- Update Safari to 10.0.3 or later on affected systems.
- Update tvOS to 10.1.1 or later on affected systems.
- If your environment tracks WebKitGTK+, verify whether the mapped WebKitGTK+ range in NVD applies and update to a fixed release before 2.16.3.
- Use the linked Apple vendor advisories and NVD record to confirm exact remediation guidance for each platform.
- Treat untrusted websites as a credible trigger path until affected versions are fully remediated.
Evidence notes
Derived from the supplied CVE description, NVD metadata, and Apple-linked vendor references. The CVE was published on 2017-02-20 and later modified in NVD on 2026-05-13; the later modified date should not be treated as the disclosure date. NVD lists affected CPEs for iPhone OS, Safari, tvOS, and WebKitGTK+ with the version ceilings provided in the source corpus.
Sources and references
Verified primary and authoritative sources
-
CVE-2017-2350 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2017-2350
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2017-2350 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2017-2350
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://security.gentoo.org/glsa/201706-15
[email protected] - Third Party Advisory
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://support.apple.com/HT207482
[email protected] - Vendor Advisory
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://support.apple.com/HT207484
[email protected] - Vendor Advisory
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://support.apple.com/HT207485
[email protected] - Vendor Advisory
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.