JavaScriptCore is Apple’s JavaScript engine for WebKit, the web platform used by Safari and all browsers on iPhone and iPad. It parses and executes JavaScript, manages memory for scripts, and exposes many of the runtime behaviors that web pages rely on.
In cyber security, JavaScriptCore matters because bugs in the engine can become high-value browser exploits. A malicious page may use carefully crafted JavaScript to trigger memory corruption, bypass safety checks, or gain code execution inside the browser process. Attackers often chain a JavaScriptCore flaw with a sandbox escape or other vulnerability to move from web content to broader device compromise.
Defenders care about JavaScriptCore because patching it closes a common entry point for drive-by attacks. On Apple devices, keeping iOS updated is critical, since all browser engines depend on WebKit and its JavaScriptCore component. Features such as Lockdown Mode also reduce exposure by limiting complex web content and narrowing the attack surface.