CVE-2023-40397: Apple macOS

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. A remote attacker may be able to cause arbitrary javascript code execution.

Affected products

• Apple macOS: before 13.5 (fixed in 13.5)
• WebKitGTK WebKitGTK: before 2.40.5 (fixed in 2.40.5)
• Wpewebkit Wpe Webkit: before 2.40.5 (fixed in 2.40.5)

Published 2023-09-06. Last modified 2026-06-17.