Apple has released an update for iPhones, iPads and Watches to patch a security vulnerability under active attack by hackers.

The security update lands as iOS 14.4.2 and iPadOS 14.4.2, which also covers a patch to older devices as iOS 12.5.2; watchOS also updates to 7.3.3.

Apple said the vulnerability, discovered by security researchers at Google’s Project Zero, may have been “actively exploited” by hackers. The bug is found in WebKit, the browser engine that powers the Safari browser across all Apple devices.

It’s not known who is actively exploiting the vulnerabilities, or who might have fallen victim. Apple did not say if the attack was targeted against a small subset of users or if it was a wider attack. It’s the third time (by our count) that Apple has pushed out a security-only update this year to fix flaws under active attack. Earlier this month the company released patches for similar vulnerabilities in WebKit.