Detect Apple WebKit Use-After-Free Exploitation Attempt (CVE-2025-43529) in Google Chronicle
Detects exploitation attempts targeting CVE-2025-43529, a use-after-free vulnerability in Apple's WebKit browser engine affecting multiple Apple products. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to arbitrary code execution when a user visits a maliciously crafted webpage. Attackers may leverage this flaw to achieve initial access or privilege escalation on macOS, iOS, and iPadOS devices.
MITRE ATT&CK
YARA-L Detection Query
rule cve_2025_43529_webkit_uaf {
meta:
author = "df00tech Detection Engineering"
description = "Detects Apple WebKit use-after-free exploitation (CVE-2025-43529) via suspicious child process spawning from browser processes"
severity = "CRITICAL"
priority = "HIGH"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-43529"
false_positives = "Browser automation, developer tooling"
events:
$parent.metadata.event_type = "PROCESS_LAUNCH"
$parent.principal.process.file.full_path = /Safari|WebProcess|com\.apple\.WebKit/ nocase
$child.metadata.event_type = "PROCESS_LAUNCH"
$child.principal.process.file.full_path = /\/bin\/(sh|bash|zsh)|python3|curl|osascript|launchctl|ncat|\/usr\/bin\/nc/ nocase
$child.principal.process.parent_pid = $parent.principal.process.pid
$parent.principal.hostname = $child.principal.hostname
match:
$parent.principal.hostname over 2m
condition:
$parent and $child
}Chronicle YARA-L rule detecting CVE-2025-43529 WebKit exploitation by correlating WebKit browser parent process events with suspicious shell or interpreter child process launches on macOS.
Data Sources
Required Tables
False Positives & Tuning
- Automated browser testing frameworks (Selenium, Playwright) in developer environments
- Legitimate macOS GUI automation using osascript triggered via browser
- MDM-based deployments using browser-initiated shell scripts
- Security software triggering shell helpers from within browser process tree
Other platforms for CVE-2025-43529
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate WebKit Child Process Spawn (macOS)
Expected signal: Process creation event: parent=osascript, child=bash; bash executing id and whoami commands
- Test 2WebProcess Curl Outbound Simulation
Expected signal: Network connection event: process=curl, initiated from simulated WebKit parent context, destination=127.0.0.1:9999
- Test 3Launchctl Persistence Attempt Post-WebKit Exploitation
Expected signal: Process creation: launchctl load with plist argument; file write to /tmp/webkit_test/test.plist; LaunchAgent registration event in macOS Unified Log
Unlock Pro Content
Get the full detection package for CVE-2025-43529 including response playbook, investigation guide, and atomic red team tests.