PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-2350 Apple CVE debrief

CVE-2017-2350 describes a WebKit flaw affecting Apple platforms that could let a remote attacker use a crafted website to bypass the Same Origin Policy and read sensitive information. Apple listed affected versions of iOS before 10.2.1, Safari before 10.0.3, and tvOS before 10.1.1. NVD also maps WebKitGTK+ before 2.16.3 to this issue. The impact is confidentiality-focused and requires user interaction through web content.

Vendor
Apple
Product
Safari
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-20
Original CVE updated
2026-05-13
Advisory published
2017-02-20
Advisory updated
2026-05-13

Who should care

Organizations and individuals running affected Apple devices or browsers, especially where users regularly browse untrusted websites. Security teams should prioritize managed fleets of iPhone/iPad, Safari on Apple systems, and tvOS deployments, as well as environments that track WebKit-based components.

Technical summary

The issue is a Same Origin Policy bypass in WebKit. In practical terms, a maliciously crafted website could cause the browser engine to expose information that should have remained isolated to a different origin. The NVD CVSS vector reflects network delivery, low attack complexity, no privileges required, and user interaction, with confidentiality impact only (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).

Defensive priority

Medium. The vulnerability does not indicate integrity or availability impact, but it can expose sensitive web-origin data and affects widely deployed client software. Remediation should be applied promptly on any systems still running affected versions.

Recommended defensive actions

  • Update affected Apple devices to iOS 10.2.1 or later.
  • Update Safari to 10.0.3 or later on affected systems.
  • Update tvOS to 10.1.1 or later on affected systems.
  • If your environment tracks WebKitGTK+, verify whether the mapped WebKitGTK+ range in NVD applies and update to a fixed release before 2.16.3.
  • Use the linked Apple vendor advisories and NVD record to confirm exact remediation guidance for each platform.
  • Treat untrusted websites as a credible trigger path until affected versions are fully remediated.

Evidence notes

Derived from the supplied CVE description, NVD metadata, and Apple-linked vendor references. The CVE was published on 2017-02-20 and later modified in NVD on 2026-05-13; the later modified date should not be treated as the disclosure date. NVD lists affected CPEs for iPhone OS, Safari, tvOS, and WebKitGTK+ with the version ceilings provided in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-2350 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-2350

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-2350 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-2350

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.