CVE-2025-43529 CrowdStrike LogScale · LogScale

Detect Apple WebKit Use-After-Free Exploitation Attempt (CVE-2025-43529) in CrowdStrike LogScale

Detects exploitation attempts targeting CVE-2025-43529, a use-after-free vulnerability in Apple's WebKit browser engine affecting multiple Apple products. This vulnerability is actively exploited in the wild (CISA KEV) and can lead to arbitrary code execution when a user visits a maliciously crafted webpage. Attackers may leverage this flaw to achieve initial access or privilege escalation on macOS, iOS, and iPadOS devices.

MITRE ATT&CK

Tactic
Initial Access Execution Privilege Escalation

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=ProcessRollup2
| ParentBaseFileName IN ("Safari", "WebProcess", "com.apple.WebKit.WebContent")
| FileName IN ("sh", "bash", "zsh", "python3", "curl", "osascript", "launchctl", "nc", "ncat", "xterm")
| PlatformType = "Mac"
| eval risk="CVE-2025-43529 WebKit UAF Exploitation Attempt"
| stats count() as EventCount, earliest(timestamp) as FirstSeen, latest(timestamp) as LastSeen, values(CommandLine) as Commands by aid, ComputerName, UserName, ParentBaseFileName, FileName, risk
| sort -EventCount
critical severity high confidence

CrowdStrike Falcon CQL detection for Apple WebKit use-after-free exploitation identifying suspicious child processes spawned from Safari or WebKit content process on macOS endpoints.

Data Sources

CrowdStrike Falcon Endpoint ProtectionCrowdStrike Falcon Data Replicator

Required Tables

ProcessRollup2

False Positives & Tuning

  • Browser automation agents running Selenium or Playwright tests on macOS
  • Enterprise IT management tools that leverage osascript via browser triggers
  • Developer workflow integrations that spawn terminal sessions from browser
  • macOS software update mechanisms initiated through Safari browser UI

Other platforms for CVE-2025-43529

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate WebKit Child Process Spawn (macOS)

    Expected signal: Process creation event: parent=osascript, child=bash; bash executing id and whoami commands

  2. Test 2WebProcess Curl Outbound Simulation

    Expected signal: Network connection event: process=curl, initiated from simulated WebKit parent context, destination=127.0.0.1:9999

  3. Test 3Launchctl Persistence Attempt Post-WebKit Exploitation

    Expected signal: Process creation: launchctl load with plist argument; file write to /tmp/webkit_test/test.plist; LaunchAgent registration event in macOS Unified Log

Last updated: 2026-06-19 Research depth: standard
References (6)

Response Playbook

Triage

  1. Confirm the affected device is an Apple macOS, iOS, or iPadOS system running a vulnerable version of Safari/WebKit prior to Apple's December 2025 patch.
  2. Review the process tree on the affected endpoint to identify whether Safari or a WebKit subprocess (WebProcess, com.apple.WebKit.WebContent) spawned unexpected child processes such as shells, curl, or osascript.
  3. Check browser history and network logs for the timeframe around the alert to identify the URL or domain that may have served the malicious page exploiting CVE-2025-43529.
  4. Determine if the suspicious child process made outbound network connections to unknown or suspicious external IPs or domains that could indicate C2 communication.
  5. Assess whether any files were written to disk by the spawned child process, particularly in /tmp, ~/Library, or ~/Downloads directories.

Containment

  1. Immediately isolate the affected endpoint from the network using MDM (Jamf, Mosyle) or EDR network isolation to prevent potential lateral movement or data exfiltration.
  2. Force-kill all WebKit/Safari processes on the affected device and block access to the identified malicious URL at the proxy, DNS, or firewall level.
  3. Revoke any tokens, credentials, or cookies that may have been accessible to the browser process at the time of exploitation.

Evidence Collection

  1. Capture a full memory dump or volatile data snapshot from the affected macOS endpoint using tools such as osxpmem or CrowdStrike's real-time response before remediation.
  2. Collect macOS Unified Logs (log show --predicate) for the WebKit and Safari subsystems covering the incident window, along with any crash reports in ~/Library/Logs/DiagnosticReports/ that may contain stack traces related to the use-after-free.
  3. Export browser history, extension list, and downloaded file metadata from the affected user profile for forensic analysis.

Escalation Criteria

  • !Escalate immediately if the spawned child process established a persistent backdoor (launchd plist, login item, or cron job) or performed credential harvesting activity.
  • !Escalate to incident response if multiple endpoints in the environment show similar WebKit exploitation indicators, suggesting a targeted campaign or watering-hole attack leveraging CVE-2025-43529.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >macOS Unified Log entries from subsystem com.apple.WebKit showing crash or memory violation events near the incident timestamp
  • >Crash reports in ~/Library/Logs/DiagnosticReports/ with process name WebProcess or com.apple.WebKit.WebContent containing SIGSEGV or SIGABRT signals
  • >Safari history database at ~/Library/Safari/History.db containing the URL of the malicious page visited
  • >Process creation audit events showing WebProcess as parent of an unexpected shell or interpreter child
  • >Network connection logs showing outbound connections from WebProcess or its child to external IPs

Tuning Guidance

Reduce false positives by adding allowlisting for known-good parent-child pairs in your organization: for example, if Selenium Grid nodes run macOS, exclude those hosts by hostname or device tag. Similarly, if your org uses browser-based osascript automation for MDM workflows, capture those specific command-line patterns and add them as exceptions. Increase confidence by correlating child process spawn alerts with concurrent outbound network connections to non-Apple IPs from the same WebKit process, which strongly indicates exploitation rather than legitimate automation. Consider tuning severity to 'high' rather than 'critical' in dev/QA environments where browser automation is common.

Hunting Queries

30-day retrospective hunt for WebKit browser processes that spawned unexpected shell or scripting child processes, which may indicate historic exploitation of CVE-2025-43529 or similar WebKit vulnerabilities before detection rules were deployed.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName in~ ("WebProcess", "com.apple.WebKit.WebContent", "Safari")
| where FileName in~ ("sh", "bash", "zsh", "python3", "curl", "osascript", "launchctl", "nc")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc
Hunting — SPL
spl 
index=* sourcetype IN ("macos:unified_log", "crowdstrike:events") earliest=-30d
(parent_process_name="WebProcess" OR parent_process_name="Safari" OR parent_process_name="com.apple.WebKit.WebContent")
process_name IN ("sh", "bash", "zsh", "python3", "curl", "osascript", "launchctl", "nc")
| table _time src_host parent_process_name process_name cmdline

Atomic Red Team Tests

Test 1 Simulate WebKit Child Process Spawn (macOS)
macos

Simulates the post-exploitation behavior of CVE-2025-43529 by launching a shell child process under a process named to mimic WebProcess, replicating the process tree pattern that detection rules target.

Command

bash 
osascript -e 'do shell script "bash -c \"sleep 1 && id && whoami\""' & disown

Cleanup

bash 
killall osascript 2>/dev/null; killall bash 2>/dev/null

Expected Telemetry

Process creation event: parent=osascript, child=bash; bash executing id and whoami commands

Expected Detection

Alert on osascript or bash spawned as child of a browser-like parent process; triggered by SPL, CQL, and EQL rules monitoring for suspicious child processes

Test 2 WebProcess Curl Outbound Simulation
macos

Simulates the post-exploitation network callback behavior that would follow a successful CVE-2025-43529 exploit, where the attacker uses the WebKit process context to beacon to a C2 server.

Command

bash 
curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:9999/beacon --max-time 5 || true

Cleanup

bash 
true

Expected Telemetry

Network connection event: process=curl, initiated from simulated WebKit parent context, destination=127.0.0.1:9999

Expected Detection

Alert on curl spawned as child of Safari/WebProcess parent, with outbound network connection to non-Apple destination; triggered by KQL and CQL detections

Test 3 Launchctl Persistence Attempt Post-WebKit Exploitation
macos

Simulates an attacker achieving persistence on a macOS device after exploiting CVE-2025-43529 by loading a LaunchAgent plist via launchctl from within a WebKit child process context.

Command

bash 
mkdir -p /tmp/webkit_test && cat > /tmp/webkit_test/test.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict><key>Label</key><string>com.test.webkit</string><key>ProgramArguments</key><array><string>/bin/sh</string><string>-c</string><string>echo test</string></array></dict></plist>
EOF
launchctl load /tmp/webkit_test/test.plist 2>/dev/null || true

Cleanup

bash 
launchctl unload /tmp/webkit_test/test.plist 2>/dev/null; rm -rf /tmp/webkit_test

Expected Telemetry

Process creation: launchctl load with plist argument; file write to /tmp/webkit_test/test.plist; LaunchAgent registration event in macOS Unified Log

Expected Detection

Alert on launchctl spawned as child of WebKit-related parent process with 'load' argument; indicative of persistence establishment following browser exploitation

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0004Privilege Escalation

Related Techniques

T1189Drive-by CompromiseT1203Exploitation for Client ExecutionT1068Exploitation for Privilege Escalation

Same Tactic: Initial Access

Popular Detections