I’m trying to understand the mechanics of WebKit vulnerabilities, such as CVE-2023-42916, which involve processing malicious web content. Specifically, I want to know if these vulnerabilities can be exploited by simply processing a link, without the user actively opening the webpage.

For instance:

• If a messaging app or email client generates a preview of a link using WebKit, could this trigger the vulnerability?
• Are there known instances or reports where WebKit vulnerabilities were exploited in such a manner?

Any insights or references to detailed technical analyses would be helpfull.

-understand the CVE-2023-42916 and know where is exactly the issue in the webkit.