Apple Safari
CVE-2024-44308
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
AnalysisAI
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously crafted web content, with Apple confirming active exploitation on Intel-based Mac systems. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS 8.8 score requiring only user interaction (visiting a malicious page) to achieve remote code execution. EPSS at 1.55% (81st percentile) is moderate but the KEV listing signals real-world targeted abuse against Apple's WebKit-based browsing stack.
Technical ContextAI
The vulnerability resides in Apple's WebKit/JavaScriptCore engine that powers Safari and all web content rendering across iOS, iPadOS, macOS, and visionOS. Apple's fix language ('addressed with improved checks') and the Intel-Mac-specific exploitation hint at a validation/type-confusion class issue in the JIT or web content pipeline, though no CWE is assigned in NVD. Affected CPE entries cover Apple Safari, iPadOS, iPhone OS, macOS, and visionOS; a Debian CPE is also listed because WebKitGTK packages downstream from upstream WebKit are similarly impacted on Debian 11. The bug is triggered purely through web content, meaning any vulnerable browsing surface (Safari tab, in-app WebView, embedded WebKit component) is a candidate vector.
RemediationAI
Vendor-released patches are available: upgrade to Safari 18.1.1, iOS/iPadOS 17.7.2 (for devices on the 17 train) or 18.1.1, macOS Sequoia 15.1.1, and visionOS 2.1.1 via Apple's standard Software Update mechanism, prioritizing Intel-based Macs given confirmed exploitation on that platform. Debian 11 administrators should apply WebKitGTK package updates from Debian Security as they are published. Where immediate patching is not possible, compensating controls include disabling JavaScript in Safari (Settings → Safari → Advanced) which neutralizes most WebKit exploitation paths at the cost of breaking nearly all modern sites, routing browsing through an enterprise web filter that blocks unknown/uncategorized domains to reduce drive-by exposure, and instructing users to avoid Safari/WebKit-embedded browsers in favor of a patched alternative engine temporarily - noting that in-app WebViews on iOS still use WebKit and cannot be swapped.
More in Debian Linux
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (
Share
External POC / Exploit Code
Leaving vuln.today