CVE-2017-2515: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue…

PriorityP261high8.8CVSS 3.0

AVNACLPRNUIRSUCHIHAH

EXPLOIT

EPSS

4.68%

90.6th percentile

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
apple	ios	—	—
apple	iphone_os	<= 10.3.1	—
apple	safari	<= 10.1	—
apple	safari	—	—
apple	tvos	<= 10.2	—
apple	tvos	—	—
debian	webkit2gtk	< webkit2gtk 2.16.3-2 (bookworm)	webkit2gtk 2.16.3-2 (bookworm)

Detection & IOCsextracted from sources · hover to see the quote

→The vulnerability is triggered via a crafted web page exploiting WebKit's FrameLoader::clear, which allows stealing variables across page navigation through memory corruption. Monitor for suspicious iframe-based navigation patterns combined with use of showModalDialog and data: URI schemes. ↗
→Exploit PoC uses nested iframes with document.open(), onreadystatechange callbacks, and __defineGetter__ overrides on contentWindow properties (e.g., 'navigator') to manipulate frame state during navigation — monitor for such DOM manipulation patterns in browser telemetry. ↗
→Exploit PoC uses data: URI scheme combined with anchor click navigation inside a sandboxed iframe to trigger the vulnerability — detect data:text/html navigations initiated programmatically inside nested iframes. ↗
→Exploit PoC uses showModalDialog with a Blob object URL (blob: scheme) to trigger cross-frame variable access — monitor for showModalDialog calls combined with URL.createObjectURL usage in WebKit-based browsers. ↗
→Affects WebKit as used in iOS before 10.3.2, Safari before 10.1.1, and tvOS before 10.2.1 — flag unpatched user agents for these products in web proxy/WAF logs. ↗

·The exploit requires a user click interaction to trigger — purely passive drive-by without user interaction will not fire this PoC. ↗
·The vulnerability is described as memory corruption with multiple issues addressed together; the FrameLoader::clear variable-stealing PoC may represent only one exploitation primitive and not the full RCE chain. ↗

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

osv8.8HIGH

vendor_debian8.8LOW

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.