CVE-2017-7059

Vulnerability

A DOMParser XSS issue exists in the WebKit component on iOS before 10.3.3, Safari before 10.1.2, and tvOS before 10.2.2 [1][2][3]. The vulnerability allows a remote attacker to cause unexpected application termination or arbitrary code execution via maliciously crafted web content [1][2].

Exploitation

An attacker can exploit this vulnerability by luring a user to visit a specially crafted website that triggers the XSS flaw in the DOMParser [1][2]. No additional authentication or local access is required; the attack is network-based and relies on user interaction to load the malicious content in a vulnerable browser or WebKit renderer.

Impact

Successful exploitation leads to arbitrary code execution within the context of the affected application, potentially allowing the attacker to gain elevated privileges or access sensitive data [1][2]. The impact is classified as a remote code execution (RCE) with high consequences for confidentiality, integrity, and availability.

Mitigation

Apple addressed this vulnerability in iOS 10.3.3, Safari 10.1.2, and tvOS 10.2.2 released on July 19, 2017 [1][2][3]. Users should update to the latest available versions via the device's update mechanism. No workaround is documented; applying the official patch is the only mitigation.