Apple WebKit flaw in Safari and iOS is being exploited, CISA warns: update your…

What happened

Apple has fixed a flaw tracked as CVE-2024-27834 in WebKit, the engine behind the Safari browser and web content in iOS, iPadOS, macOS, tvOS and watchOS. The fix shipped on May 13, 2024 in Safari 17.5, iOS and iPadOS 17.5, iOS and iPadOS 16.7.8, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. The bug was found by researcher Manfred Paul working with Trend Micro’s Zero Day Initiative.

According to Apple, an attacker who can already read and write arbitrary memory on a device may be able to bypass a protection called Pointer Authentication. On November 4, 2026, the US agency CISA added the flaw to its catalog of actively exploited vulnerabilities. ENISA’s European Vulnerability Database (EUVD) lists it as exploited since the same day (entry EUVD-2024-25027). Nobody has publicly said who is exploiting it or against whom.

In other words, the fix has been available for more than two years. If your devices are kept up to date, you are protected. The risk mainly concerns devices that have not been updated for a long time or no longer receive updates.

Why it is dangerous

Modern Apple chips include a protection called Pointer Authentication. Put simply, important references in memory, such as the address where a program should continue, get a cryptographic signature, a bit like a stamp. If an attacker forges the address, the stamp does not match and the system stops the program. CVE-2024-27834 makes it possible to get around this check.

On its own, this flaw does not let an attacker in. Apple says explicitly that the attacker must already be able to read and write arbitrary memory, which usually requires a different bug. Think of it as a lock pick for the second lock: the first lock has to be beaten some other way. So an attacker can only use it as one step in a chain of several bugs.

NVD rates the flaw CVSS 5.5 out of 10, which is medium severity. CVSS is an international scale for rating how serious a vulnerability is. According to the NVD vector, it is a local attack requiring low privileges and no user interaction, and the main impact is on system integrity. NVD classifies it as CWE-287, improper authentication.

More important than the score is the fact that the flaw is in the CISA KEV catalog. This is a list of vulnerabilities for which the US agency CISA has evidence of real-world exploitation. US federal agencies must fix this flaw by November 18, 2026. CISA does not yet say whether ransomware groups are using it.

The EPSS score, which estimates the probability of exploitation in the next 30 days, is about 0.6%. For a flaw already listed in KEV, however, confirmed exploitation carries more weight than this estimate.

Who is affected

Affected are Apple devices running software older than the following versions:

Safari 17.5 on macOS Monterey and macOS Ventura
macOS Sonoma 14.5
iOS and iPadOS 17.5
iOS and iPadOS 16.7.8 for older devices
tvOS 17.5 (Apple TV HD and Apple TV 4K, all models)
watchOS 10.5 (Apple Watch Series 4 and later)

In a business, this mostly means company iPhones and iPads, employees’ MacBooks and iMacs, and Apple TVs in meeting rooms. WebKit renders web content not only in Safari but also in many apps that open web pages inside them.

The flaw is in Apple software. Windows or Linux computers and Android phones are not affected. Neither are Apple devices already running the listed version or newer.

How to check if you are affected

On a Mac, you can check the system and Safari versions in Terminal with these commands. Both only read information and change nothing.

sw_vers

defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

Mac without Terminal: Apple menu > About This Mac
iPhone and iPad: Settings > General > About, iOS or iPadOS version
Apple TV: Settings > General > About
Apple Watch: Watch app on the iPhone > General > About

If you manage devices through MDM (for example Microsoft Intune or Jamf), review the inventory and filter for devices running versions older than the fixed ones.

How to fix it

Apple does not list any workaround, so updating is the only protection. The fixed versions are just the minimum. We recommend installing the latest version each device supports, since it also includes later security fixes.

List every Apple device in the company, including personal devices people use to access company email and data.
Update iPhones, iPads and Macs used for web browsing and email first: Settings > General > Software Update, on a Mac System Settings > General > Software Update.
On macOS Monterey and macOS Ventura, install at least Safari 17.5, ideally a newer macOS as well.
Update older iPhones and iPads that cannot run iOS 17 to at least iOS or iPadOS 16.7.8.
Then update Apple TVs to tvOS 17.5 or later and Apple Watches to watchOS 10.5 or later.
Retire devices that no longer receive updates or disconnect them from company accounts.

In your MDM, you can set a minimum allowed OS version. Devices running older software are then blocked from company email and data until they are updated.

What if you may already be compromised

Neither Apple nor CISA has published specific indicators of compromise, meaning traces that would reveal an attack. Any check can therefore only be general.

Which devices ran versions older than the fixed ones for a long time
Unknown profiles under Settings > General > VPN & Device Management
Unknown devices signed in to Apple IDs or company accounts
Unusual sign-ins to company email and cloud services such as Microsoft 365 or Google Workspace

If Apple sends someone in your company a threat notification about a targeted attack, or if people in sensitive roles are involved, bring in a mobile forensics specialist. For such people, also consider Lockdown Mode. If you suspect a compromise, change company account passwords from a different, clean device.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

Apple WebKit flaw in Safari and iOS is being exploited, CISA warns: update your devices