# CVE-2021-1879

This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited..

- Page: https://www.vulneraibility.com/cve/CVE-2021-1879
- CVSS: 6.1
- Known exploited: yes, in CISA KEV since 2021-11-03; CISA due date 2021-11-17
- EPSS: 7.08% (percentile 94.3)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2025-01-29)
- Weakness: CWE-79
- Published: 2021-04-02

## Affected versions

- Apple iOS: affected < 12.5
- Apple iOS and iPadOS: affected < 14.4
- Apple watchOS: affected < 7.3

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://support.apple.com/en-us/HT212256
- [other] https://support.apple.com/en-us/HT212257
- [other] https://support.apple.com/en-us/HT212258
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1879

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.