Apple has released emergency security updates for iOS and iPadOS, macOS, tvOS and watchOS devices that patch three (3) critical multi-platform Webkit browser engine zero-day vulnerabilities. According to researchers, there are indications that the flaws are likely being exploited in highly targeted attacks by state-sponsored threat actors to deliver spyware to the mobile devices of high-profile individuals, such as politicians, journalists, and dissidents. The first vulnerability, tracked as CVE-2023-28204, is an out-of-bounds read bug that may cause the browser to disclose sensitive information after the processing of certain web content. CVE-2023-32373 is a use-after-free vulnerability that could be exploited to allow arbitrary code execution through the processing of malicious web content. The third flaw, tracked as CVE-2023-32409, is a browser sandbox escape vulnerability that allows an attacker to break free of the constraints of the sandbox. The exploitation of this flaw could allow a remote attacker to directly access the host device and outside processes. Although Apple has stated that it’s aware that these zero-days may be under active exploitation, it didn’t disclose any technical information regarding these attacks or information about the threat actors who may be exploiting them. These flaws have been fixed, and CTIX analysts recommend all Apple product users ensure that their devices are running the most up-to-date software to prevent exploitation.