It has been proved that it has been actively exploited by hackers. Apple announced that iOS 16.1.2 released two weeks ago fixed the zero-day vulnerability of WebKit.

CTOnews.com, December 14 (Xinhua)-- Apple officially confirmed that an update released to iPhone two weeks ago fixed a zero-day vulnerability, and there is evidence that the vulnerability has been actively exploited by hackers.

Apple said in today's updated support document that the iOS 16.1.2 update, launched on November 30, fixed a zero-day vulnerability in WebKit, affecting both iPhone 8 and newer models.

CTOnews.com learned that WebKit is a browser engine supported by Safari and other applications, which can be exploited by hackers to run arbitrary malicious code on iPhone. Apple said security researchers at Google's threat Analysis team (TAP), which investigates spyware, hacker attacks and cyber attacks, discovered and reported WebKit vulnerabilities.

It is not uncommon for lawbreakers to find vulnerabilities aimed at WebKit as a way to hack into the operating system of devices and users' private data. WebKit errors can be "linked" to other vulnerabilities to break through the device's multiple layers of defense.

In its disclosure on Tuesday, Apple said there was evidence that hackers had exploited the vulnerability before iOS 15.1, released in October 2021. Therefore, for those users who have not yet updated to iOS 16, Apple has also released iOS and iPadOS 15.7.2 to fix WebKit vulnerabilities for users running iPhone 6s and later and some iPad models.

The error is traced to CVE-2022-42856 or WebKit 247562. It is not clear why Apple concealed the details of the error for two weeks. Neither Apple nor Google responded to requests for comment.