Apple Safari
CVE-2024-44308
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts malicious WebKit content
-
DeliveryLure victim to page via phishing or watering hole
-
ExploitVictim's Safari renders crafted JavaScript/DOM
-
ExecutionTrigger memory-safety flaw in WebKit
-
PersistAchieve arbitrary code execution in renderer
-
ImpactStage follow-on payload or sandbox escape
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content in Safari or any WebKit-rendering surface (in-app WebView, Mail preview that renders remote content, etc.) on an unpatched Apple OS - this is the UI:R user-interaction requirement reflected in the CVSS vector. No authentication, no special privileges, and no non-default configuration are needed; default Safari/WebKit behavior is sufficient. The known in-the-wild exploitation is specifically reported by Apple against Intel-based Mac systems, suggesting the working exploit chain is tuned to Intel-Mac internals even though the underlying flaw is present across all listed Apple platforms and the Debian WebKitGTK package. |
| Impact | The signals align toward high real-world priority: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-reachable, low-complexity, unauthenticated drive-by with full CIA impact requiring only a user to visit a page, and CISA KEV plus Apple's own statement confirm in-the-wild exploitation on Intel Macs. EPSS at 1.55% (81st percentile) is relatively modest compared to the KEV listing, which is consistent with targeted exploitation rather than mass commodity scanning - a common pattern for Apple browser zero-days delivered via watering-hole or targeted phishing. The Intel-Mac caveat is a real scoping factor: Apple explicitly notes awareness of exploitation on Intel-based Macs, but the patch covers all supported Apple platforms, so Apple Silicon and iOS users should still be considered at risk until patched. No conflicting signals were identified in the supplied data. |
| Exploit ScenarioDerived | An attacker hosts a malicious page (or compromises a trusted site / serves a malicious ad) containing crafted JavaScript or DOM content that, when rendered by an unpatched Safari or WebKit-based view, triggers the memory-safety flaw and executes attacker-chosen code in the renderer process. Apple has acknowledged exploitation on Intel-based Macs, consistent with a targeted watering-hole or spearphishing-link delivery typical of nation-state operators. While Apple does not publish PoC, the KEV listing confirms working exploit code exists in adversary hands. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously crafted web content, with Apple confirming active exploitation on Intel-based Mac systems. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS 8.8 score requiring only user interaction (visiting a malicious page) to achieve remote code execution. EPSS at 1.55% (81st percentile) is moderate but the KEV listing signals real-world targeted abuse against Apple's WebKit-based browsing stack.
RemediationAI
Vendor-released patches are available: upgrade to Safari 18.1.1, iOS/iPadOS 17.7.2 (for devices on the 17 train) or 18.1.1, macOS Sequoia 15.1.1, and visionOS 2.1.1 via Apple's standard Software Update mechanism, prioritizing Intel-based Macs given confirmed exploitation on that platform. Debian 11 administrators should apply WebKitGTK package updates from Debian Security as they are published. Where immediate patching is not possible, compensating controls include disabling JavaScript in Safari (Settings → Safari → Advanced) which neutralizes most WebKit exploitation paths at the cost of breaking nearly all modern sites, routing browsing through an enterprise web filter that blocks unknown/uncategorized domains to reduce drive-by exposure, and instructing users to avoid Safari/WebKit-embedded browsers in favor of a patched alternative engine temporarily - noting that in-app WebViews on iOS still use WebKit and cannot be swapped.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Apple's WebKit/JavaScriptCore engine that powers Safari and all web content rendering across iOS, iPadOS, macOS, and visionOS. Apple's fix language ('addressed with improved checks') and the Intel-Mac-specific exploitation hint at a validation/type-confusion class issue in the JIT or web content pipeline, though no CWE is assigned in NVD. Affected CPE entries cover Apple Safari, iPadOS, iPhone OS, macOS, and visionOS; a Debian CPE is also listed because WebKitGTK packages downstream from upstream WebKit are similarly impacted on Debian 11. The bug is triggered purely through web content, meaning any vulnerable browsing surface (Safari tab, in-app WebView, embedded WebKit component) is a candidate vector.
Know when Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
Executive ViewAI
Apple Safari, iOS, iPadOS, and macOS systems are vulnerable to remote code execution attacks triggered by visiting maliciously crafted websites. This vulnerability is confirmed actively exploited via CISA KEV listing with no patch currently available, creating immediate risk to any organization with Apple devices connected to the internet.
No vendor-released patch identified at time of analysis. Interim mitigations: disable Safari or replace with sandboxed browser alternatives (Chrome, Firefox, Edge); disable JavaScript in Safari settings; implement web content filtering via proxy/firewall to block known malicious sites; deploy endpoint detection and response (EDR) solutions for real-time exploitation detection; require VPN for web browsing; restrict internet access for high-risk user segments until patch availability.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
GitHub PoC
Exploit-DB