CVE-2022-22589: Apple iPadOS

Medium severity, CVSS 6.1. EPSS: 2% chance of exploitation in the next 30 days.

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing a maliciously crafted mail message may lead to running arbitrary javascript.

Affected products

• Apple iPadOS: before 15.3 (fixed in 15.3)
• Apple iPhone OS: before 15.3 (fixed in 15.3)
• Apple Mac OS X: from 10.15, before 10.15.7 (fixed in 10.15.7); version 10.15.7 only
• Apple macOS: from 11.0, before 11.6.6 (fixed in 11.6.6); from 12.0.0, before 12.2 (fixed in 12.2)
• Apple Safari: before 15.3 (fixed in 15.3)
• Apple tvOS: before 15.3 (fixed in 15.3)
• Apple watchOS: before 8.4 (fixed in 8.4)

Published 2022-03-18. Last modified 2026-06-17.